9

I have a bash session on tty2 and an ssh-agent process belonging to me (same user id) from a previous session (TTY = ?)

On tty2, ssh-add says : Could not open a connection to your authentication agent.

Do I have to start an eval $(ssh-agent) each time I log in, even when there's already an ssh-agent process running ? But then at the end, I will have many ssh-agent process instances running :-(

EDIT : I would like to use my already running ssh-agent process.

I found a way to contact my already running ssh-agent like this :

export SSH_AUTH_SOCK=$(find /tmp/ssh-*/ -user $USER -type s -name "agent.*" 2>/dev/null | head -1)
export SSH_AGENT_PID=$(echo $SSH_AUTH_SOCK | cut -d. -f2)

but I'm not sure this is very secure.

EDIT 2: The command eval $(ssh-agent) starts a new instance of the ssh-agent process every time I run this command :-(

Improve this question

2 Answers 2

Reset to default
7

You could eval and save the ssh-agent output at the same time,

eval $(ssh-agent | tee agent.env)

then from other terminals or subsequent sessions,

source agent.env

Tighten up the permissions to be slightly more secure,

chmod go-rwx agent.env
Improve this answer
8
  • I guess there is security issue here. If one gets access to the root privilege and is a bad person, he could still all my ssh-agent keys :-( Commented Mar 30, 2018 at 15:12
  • 1
    @SebMa I think that root user can use the private keys but not still them. From the man page: The agent will never send a private key over its request channel. Instead, operations that require a private key will be performed by the agent, and the result will be returned to the requester. Commented Mar 30, 2018 at 16:16
  • @OrtomalaLokni You are absolutely right, that was a typo, I meant use instead of still :) Commented Mar 30, 2018 at 17:58
  • 2
    @SebMa If a malicious person gets root access, then your SSH keys are the least of your problems. Commented Apr 22, 2018 at 9:26
  • 1
    @SebMa A root user could use your agent without the file, it's really easy to figure out where the control socket is. I'm just pointing out that if you don't trust root, then you have bigger problems than keeping your SSH keys secure. Commented Apr 23, 2018 at 10:06
5

First of all, are you doing this over an ssh session? If so, then you can use ssh -A [email protected] and don't even use ssh-agent. The -A option will forward your host's ssh-agent to the remote server. Then you don't even need to copy your ssh keys to the remote server.

Back to the original question: The problem with running ssh-agent is that by default it will use a different random socket name every time. What you want to do is use the ssh-agent -a option to provide a fixed socket. Then no matter how many times you call it, it won't start another ssh-agent.

Here's a simple script that will always re-use the same ssh-agent, or start ssh-agent if it isn't running. You can easily combine these 3 lines into a 1 line alias as well.

# set SSH_AUTH_SOCK env var to a fixed value
export SSH_AUTH_SOCK=~/.ssh/ssh-agent.sock

# test whether $SSH_AUTH_SOCK is valid
ssh-add -l 2>/dev/null >/dev/null

# if not valid, then start ssh-agent using $SSH_AUTH_SOCK
[ $? -ge 2 ] && ssh-agent -a "$SSH_AUTH_SOCK" >/dev/null

source

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.