Is there a way to maintain ssh-agent connectivity in different screens?

Question

Whenever I use ssh-agent for passwordless logins it doesn't work across different logins and screen sessions, even if they are concurrent.

I suspect it uses some shell variables that don't work across different sessions. Is there some way to configure it or get it to use some kind of variables that can be present on all sessions?

Answer 1

I use keychain to manage my ssh-agent environment variables, and it deals with making sure only one agent is running at a time. From my .bashrc on appropriate machines:

# is this an interactive shell?
if [[ $- == *i* ]]; then
    # set up ssh key server
    if [[ -x /usr/bin/keychain ]]; then
        eval $(keychain --eval --ignore-missing the <keys I want>)
    fi
fi

It stores the environment variables in ~/.keychain, runs the agent if it isn't found, and returns the new or existing variables to the eval. I set it up a few years ago and haven't touched it. If you have ssh-askpass installed, it will be able to prompt for the password in an X11 environment even when the shell running keychain isn't visible (such as X11 init scripts).

There are other ways to use it, but this works for me across multiple Linux workstations, including logging into a workstation from remote when I'm not logged into X11 there.

Answer 2

Yes, ssh uses the SSH_AUTH_SOCK variable to access the agent.

If you start different agents in different sessions they will not share the keys.

Run ssh-agent to see the variables set by this instance.

Read man ssh-agent to find out about possible options. (Especially -a should be helpful in your case.)

The best way to share one agent pretty much depends on your situation. You have to make sure that one and only one agent is running, and that all your sessions have the environment set to use it.

If you are using some desktop environment this usually starts up an ssh-agent and sets the environment to make it available to all processes started inside the desktop session. - If you want to share the a new agent for all your screen sessions you can start screen as ssh-agent screen. - If you want to ssh inside the box and access your agent this is also possible, but you are on your own.

Answer 3

You can make a script for everyone's login process which

1. checks if at least one ssh-agent instance is running (for this user)
2. selects the instance to be used (the oldest)
3. checks whether the socket info for this process is available (and correct)
4. in case of success takes this info in its own environment
5. and maybe kills the other instances (at least its own if there is one)

ps -o pid,etime,args --no-headers --sort=start_time \
  -p $(pgrep --uid $USER ssh-agent) | 
    awk '{print $1; exit;}'

gives you the PID of the oldest ssh-agent instance. This would be easier with pgrep --uid $USER --oldest ssh-agent but this way you easily get the PIDs of the other instances, too.

You could write $SSH_AUTH_SOCK in a file ~/.ssh/env/$PID (if $SSH_AGENT_PID of the current process equals $PID):

echo "export SSH_AUTH_SOCK=$SSH_AUTH_SOCK" > ~/.ssh/env/$PID

Other sessions could check whether the file exists and is still valid and import it:

bash -c 'test -e ~/.ssh/env/$PID || exit 1;
  . ~/.ssh/env/$PID; test -e $SSH_AUTH_SOCK' && . ~/.ssh/env/$PID

Answer 4

Use the excellent ssh-ident which supports multiple identities for additional security.

It's a drop-in wrapper for ssh, scp:

ln -s /usr/bin/ssh-ident ~/bin/ssh
ln -s /usr/bin/ssh-ident ~/bin/scp

There are a multitude of roll-your-own answers, but why re-invent the wheel?