1

[SSH] "Could not open a connection to your authentication agent". error

I am trying to add ssh keys into my ssh agent. I start by making sure that the ssh-agent is running.

exec ssh-agent bash

I make sure that ssh-agent is running.

ps axu | grep [s]sh

and get the following

root 1562 ... ssh-agent bash

The env variables are set correctly.

SSH_AGENT_PID=1562

SSH_AUTH_SOCK=/tmp/ssh-699iHAxuK4xX/agent.1561

However when I try to add the private key using

sudo ssh-add ~/.ssh/peter-key

I get the ssh error

Could not open a connection to your authentication agent.

I have tried the suggestions on stackoverflow and serverfault but nothing.

Note: I am running a linux machine on one of the free tier AWS machines with ubuntu. My instance's security group allow (temporarily) all incoming and outgoing ssh connections from any IP address. Anyone know what the error could be?

Community
  • 1
  • 1
Wakahiu Njenga
  • 113
  • 1
  • 7

1 Answers1

2

Just use

ssh-add ~/.ssh/peter-key

...not...

sudo ssh-add ~/.ssh/peter-key

Using sudo (optionally/configurably, but typically) clears a number of environment variables, including the ones you just verified were set. (Compare output of sudo env and plain env to see this effect).

If you must use sudo to read the key, then you can ensure that the necessary environment variable is set on the other side by doing so explicitly yourself:

sudo env "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" ssh-add ~/.ssh/peter-key

However, it's possible for security-sensitive programs working with UNIX domain sockets to check the ownership and permission of software on the other end of that socket, and to refuse to communicate with anything running on a user account different from what they expect, so it's possible that this approach may not be future-proof against security features added to ssh-agent.

Charles Duffy
  • 280,126
  • 43
  • 390
  • 441
  • It would seem that `env` may not be necessary here according to a quick look at the man page (also using `env` changes which command is checked against sudo policy doesn't it? Just in case that matters.). – Etan Reisner May 21 '15 at 23:07
  • @EtanReisner, true, but to allow overriding the environment with `sudo var=value commandname ...` *also* requires appropriate configuration in the sudoers file. Also, frankly, `sudo` can be configured so many different ways that I prefer to take it out of the picture as early in the process as possible; the behavior of `env` is far less variable. – Charles Duffy May 21 '15 at 23:08
  • Fair enough (barring an environment that specifically allows `ssh-add` or whatever and disallows `env` at least). Needing `sudo` for `ssh-add` seems odd to begin with. – Etan Reisner May 21 '15 at 23:50