Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to enable ForwardAgent in the "Publish over SSH" Jenkins Plugin. This would allow jenkins to execute deployments, rsyncs and svn+ssh checkouts on remote servers. But there's no option for this in the GUI.

ForwardAgent is set to yes in /etc/ssh/ssh_config and in /var/lib/jenkins/.ssh/config, but when Jenkins jobs login over ssh, the remote session does not have the key loaded in agent. ("Could not open a connection to your authentication agent.")

Is there a way to force ForwardAgent, or a better way to do this (via a Jenkins slave)?

Thanks for any ideas, much appreciated!

share|improve this question
"Could not open a connection to your authentication agent." means a failure to communicate to the agent. Please provide output of following commands when executed remotely: ssh-add -l; echo $SSH_AUTH_SOCK; ls -ld $SSH_AUTH_SOCK – yarek Feb 7 '12 at 21:47
@yarek, it looks like it's not finding $SSH_AUTH_SOCK: ` SSH: EXEC: STDOUT/STDERR from command [ssh-add -l; echo SSH_AUTH_SOCK is "$SSH_AUTH_SOCK"; ls -ld $SSH_AUTH_SOCK] ... Could not open a connection to your authentication agent. SSH_AUTH_SOCK is drwxr-xr-x 9 user user 4096 2012-02-06 18:43 . ` – r_2 Feb 7 '12 at 22:41
I probably need to start agent and set that env var on jenkins startup. Let me try that... – r_2 Feb 7 '12 at 22:47
do you have the agent started on your local machine? The commands above should tell. – yarek Feb 8 '12 at 12:34
When do you enter the password for the agent to load the key? Is that a different user than the one jenkins runs on? – AndreasM Feb 10 '12 at 12:00

I see this question has been unanswered for over a year, but here is how I solved the problem.

What you want to do is make sure that the user that runs jenkins

  1. checks to see if ssh-agent is running (if not, start it)
  2. checks to see if a key is loaded (if not, load one)

Put this in your ~/.bash_profile for the user that runs jenkins of the user that needs to forward agent, to ensure it runs with each new shell:


function start_agent {
  echo "Initializing new SSH agent..."
  /usr/bin/ssh-agent | sed 's/^echo/#echo/' > "${SSH_ENV}"
  echo succeeded
  chmod 600 "${SSH_ENV}"
  . "${SSH_ENV}" > /dev/null
  ssh-add .ssh/id_rsa
  cat .ssh/

#Source SSH Settings

if [ -f "${SSH_ENV}" ]
  . "${SSH_ENV}" > /dev/null
  ps -ef | grep ${SSH_AGENT_PID} | grep ssh-agent > /dev/null || {

if [ `ssh-add -l | grep "The agent has no identities." | wc -l` == 1 ]
  ssh-add .ssh/id_rsa
  cat .ssh/

About 50% of the code here I took from somewhere else but can't remember where to give credit. This should be fairly portable, and its use need not be limited to jenkins it should work in any ssh-agent forwarding situation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.