SSH key added to agent, but keeps asking for password
I have my key added to ssh-agent and they show up in ssh-add -l. When I try to actually SSH to a host that requires the key, I still get prompted for a password. I enter it again and again and it seemingly refuses to cache it.
Frustratingly, this configuration is copied between several computers and only one of them has the problem, and it started recently. It is also versioned in git and I can tell I haven't changed it in a while. I used a GUI wallet manager (kwallet) to remember the passphrase, so I don't even know why it's asking for the password at all.
What could possibly account for this, and where do I start troubleshooting?
1 answer
After some digging, I was able to figure out the problem. I actually have multiple keys. In Kwallet, I noticed that one of them has the wrong passphrase. So looks like I put the passphrase of Key X for both keys X and Y, and now Y is failing (because that's the wrong passphrase). It looks like Kwallet decided to remember this and never ask me, while ssh-agent kept silently failing to unlock and never telling me. Re-adding the key with correct passphrase didn't help because it kept getting the wrong passphrase from Kwallet.
To help future readers, I would recommend troubleshooting like so:
- Check how many SSH agents are running:
pgrep ssh
- If any are running, it's better to kill them all with
pkill sshso you can start fresh - You can do it with
env | rg ssh
- Check the environment variables are set. When you run
ssh-agent, it will print some commands that are meant to be sourced by a shell. These set the envarsSSH_AGENT_PIDandSSH_AUTH_SOCK. Of course their values will change at every run ofssh-agent, so it is better to dossh-agent > ~/.ssh/ssh-agent.envand then source the .env file, so that you can also inspect it later.
-
SSH_AGENT_PIDmust match the actual PID frompgrep ssh - The file in
SSH_AUTH_SOCKmust exist
- Check that keys are added.
ssh-add -lwill show currently cached keys.ssh-add /path/to/keywill add a key.
- The key you want must be present.
- Check the cached passphrase. When adding keys, the agent should ask you for a passphrase in a manner determined by the envars
SSH_ASKPASSandSSH_ASKPASS_REQUIRE. These are sometimes set to various password managers. For example,SSH_ASKPASS=$(which ksshaskpass)with kwallet installed allows you to check "remember password" when entering your passphrase. If a credential store is configured with these envars, open that store and see if you can find anything about the keys. It is sometimes useful to delete the saved SSH key passphrases from this store, so that it forces you to enter it again next time you dossh-add. This will eliminate the possibility of an incorrect passphrase like I describe in the beginning of my post.
0 comment threads
0 comment threads