Why does ssh-agent need root access?

I just installed Archbang and am trying to clone a Git project that requires SSH keys.

I've followed the Github guide for success in the past, on Ubuntu and RedHat blocks, but for some reason it doesn't work for me on my fresh Arch install.

I have successfully generated SSH public and private key pairs using this command:

ssh-keygen -t rsa -b 4096 -C "email@address"

      

But when I go to start the SSH agent and add my public key, I run into problems.

[user@arch ~]$ eval "$(ssh-agent -s)"
bind: Permission denied
unix_listener: cannot bind to path: /tmp/ssh-ZqYqSabxjZeA/agent.9328

      

This is successful, however, if I run it as root:

[user@arch ~]$ eval "$(sudo ssh-agent -s)"
[sudo] password for user: 
Agent pid 9146

      

But I'm pretty sure I don't want to SSH as root.

Continuing forward, when I try to use ssh-add

, I also get permission errors, but this time as standard user and root:

[user@arch ~]$ ssh-add .ssh/id_rsa.pub
Could not open a connection to your authentication agent.
[user@arch ~]$ sudo ssh-add .ssh/id_rsa.pub
Could not open a connection to your authentication agent.

      

So now I'm really confused.

I tried to open the bash process as root to do this, but 1) I don't like the idea, and 2) it still doesn't work, but this time for a different reason:

[user@arch ~]$ sudo ssh-agent -s
[root@arch ~]# ssh-add .ssh/id_rsa.pub
Enter passphrase for .ssh/id_rsa.pub:
Bad passphrase, try again for .ssh/id_rsa.pub:

      

For some reason, this in the root shell causes my SSH keyword passphrase to reject; I've tried this a few times, with the simplest phrases, so I'm pretty sure I gave it the correct passphrase.

I'm at a loss. I really don't like all this stuff sudo

and I don't know why it seems necessary; I have checked the permissions on the .ssh directory and its files, even if you delete the entire directory and restore the keys to make sure they are not generated with the wrong permissions.

Can someone please help me here? What am I doing wrong?

EDIT: In response to the suggested answers, I tried this again using the socket location inside my home directory. Here are the results:

[user@arch ~]$ mkdir -m 700 ~/.ssh
[user@arch ~]$ ssh-keygen -t rsa -b 4096 -C "email@address"
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
...
[user@arch ~]$ chmod 644 .ssh/id_rsa.pub && chmod 600 .ssh/id_rsa
[user@arch ~]$ eval "$(ssh-agent -sa .ssh-agent.$$)"
Agent pid 1881
[user@arch ~]$ ssh-add .ssh/id_rsa.pub
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '.ssh/id_rsa.pub' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.

      

At this point, I am confused as to why these permissions are not acceptable, and why it thinks my public key is a private key. But I am humorous by changing the permissions to 600 and trying to add it again.

[user@arch ~]$ chmod 600 .ssh/id_rsa.pub
[user@arch ~]$ ssh-add .ssh/id_rsa.pub
Enter passphrase for .ssh/id_rsa.pub:
Bad passphrase, try again for .ssh/id_rsa.pub:

      

And now I ended up in the same place as before: he doesn't like the phrase I created for my SSH key. What's happening?! This is really puzzling.

+3


source to share


2 answers


It seems to be the user you are working with as it does not have write access to the default ssh-agent socket location.

This should fix your problem:

ssh-agent -a ~/.ssh-agent.$$

      



Specifies the location of the socket with an option -a

, like ~/.ssh-agent.$$

inside your home directory.

Permissions issue could be caused by simple UNIX permissions (i.e. /tmp

cannot be written by this user) or SELinux or whatever.

+1


source


After many hours of struggling with this, I finally tracked down the source of my problems.

  • My umask was set completely wrong: when I installed the environment after installation, I accidentally put umask 755

    in mine .bashrc

    ; I meant it was 755 for my file permissions, in which case it umask

    should have been set to 022

    or 002

    (I went with the latter). This wrong one umask

    turned out to be the root (hehe) of all my permission errors: files and directories created by all the various SSH commands were created with the wrong permissions.
  • I was trying to make ssh-add

    my public key instead of my private key; I couldn't figure out why it said my passphrase was wrong, even though I was 100% sure it was correct. The reason was that the password was for a private key; the public key was not password protected, so trying ssh-add

    to enter it and enter a password for it resulted in Bad Passphrase errors.


Thanks everyone for your help! You put me on the path to finding a solution that worked for me. After fixing these errors, I was successfully able to start ssh-agent

without root access and add my private SSH key.

0


source







All Articles