What part of SSH forwarding sets up SSH_AUTH_SOCK?

Question

I'm trying to get SSH agent forwarding working from my Mac to a Debian server. On my Mac, I have verified that I have:

• SSH_AUTH_SOCK exists
• ssh-add -l shows my identities
• ./ssh/config has settings to enable ForwardAgent

Passwordless login to the remote server works fine. However, none of my identities are available there and the SSH_AUTH_SOCK is empty.

I'd like to understand how this gets set up in the remote environment, and what am I missing to make it work?

Update:

My server is set up with AllowAgentForwarding=yes in sshd_config and ForwardAgent=yes in ssh_config.

I found some tutorials that suggest running eval `ssh-agent `, so I tried that but I suspect this is meant for the client machine. This did set up a SSH_AUTH_SOCK when I ran it on my server, but it doesn't seem to connect back to the client agent, and it says "The agent has no identities".

Answer 1

On my Mac with OS 10.6.x I found that agent forwarding didn't work until I added my key to the Apple keychain, with the following:

ssh-add -K ~/.ssh/id_rsa 

where ~/.ssh/id_rsa contains my private ssh key

I've a blog entry about setting up ssh host configuration entries to simplify ssh command-lines that may be of interest

Answer 2

The client that runs the agent needs to have agent forwarding enabled. Not the server.

Never enable it globally, but on a per-host basis in ~/.ssh/config:

Host myserver.foo.local
ForwardAgent yes

Or use the -A option when connecting:

ssh -A myserver.foo.local

Answer 3

The server also has to enable agent forwarding.