Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get SSH agent forwarding working from my Mac to a Debian server. On my Mac, I have verified that I have:

  • SSH_AUTH_SOCK exists
  • ssh-add -l shows my identities
  • ./ssh/config has settings to enable ForwardAgent

Passwordless login to the remote server works fine. However, none of my identities are available there and the SSH_AUTH_SOCK is empty.

I'd like to understand how this gets set up in the remote environment, and what am I missing to make it work?


My server is set up with AllowAgentForwarding=yes in sshd_config and ForwardAgent=yes in ssh_config.

I found some tutorials that suggest running eval `ssh-agent `, so I tried that but I suspect this is meant for the client machine. This did set up a SSH_AUTH_SOCK when I ran it on my server, but it doesn't seem to connect back to the client agent, and it says "The agent has no identities".

share|improve this question
up vote 3 down vote accepted

On my Mac with OS 10.6.x I found that agent forwarding didn't work until I added my key to the Apple keychain, with the following:

ssh-add -K ~/.ssh/id_rsa 

where ~/.ssh/id_rsa contains my private ssh key

I've a blog entry about setting up ssh host configuration entries to simplify ssh command-lines that may be of interest

share|improve this answer
Thanks, I had figured it out a while back: your answer is the correct solution on a Mac client. – Andrew Vit Jul 30 '11 at 22:18

The server also has to enable agent forwarding.

share|improve this answer
I've tried setting AllowAgentForwarding yes in sshd_config and restarting ssh on the server. I still get the error "Could not open a connection to your authentication agent" when I try to do anything from the server. – Andrew Vit Nov 3 '10 at 5:46

The client that runs the agent needs to have agent forwarding enabled. Not the server.

Never enable it globally, but on a per-host basis in ~/.ssh/config:

ForwardAgent yes

Or use the -A option when connecting:

ssh -A
share|improve this answer
Thanks for your answer. Yes, I already have my .ssh/config configured this way. I see SSH_AUTH_SOCK on my end, but not inside the SSH session. I was trying to understand what part of the client/server environment is responsible for setting up that socket, since I'm not seeing it. – Andrew Vit Nov 6 '10 at 9:22
Does the client show in verbose mode that it is requesting agent forwarding? ssh -vvv -A true 2>&1 | grep agent – unixtippse Nov 7 '10 at 7:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.