Bug#1103522: openssh-client: ssh-agent socket created in an unpredictable path

Antoine Le Gonidec <[email protected]>
Newsgroups gmane.linux.debian.devel.ssh
Message-ID <20250508171806.5c8dbfaa__1231.61107055552$1746717687$gmane$org@hal9000.dotslashplay.it>
> >> If your output looks the same as above, can you share the output of:
> >> 
> >>     systemctl --user status ssh-agent.socket ssh-agent.service
> >> 
> >> That would let me see what your local process supervisor believes is
> >> going on with this service.  
> >
> > ○ ssh-agent.socket - OpenSSH Agent socket
> >      Loaded: loaded (/usr/lib/systemd/user/ssh-agent.socket; enabled;
> > preset: enabled) Active: inactive (dead)
> >    Triggers: ● ssh-agent.service
> >        Docs: man:ssh-agent(1)
> >      Listen: /run/user/1000/openssh_agent (Stream)
> >
> > × ssh-agent.service - OpenSSH Agent
> >      Loaded: loaded (/usr/lib/systemd/user/ssh-agent.service; static)
> >      Active: failed (Result: exit-code) since Fri 2025-04-18 16:26:54 CEST;
> > 2 weeks 5 days ago Duration: 18min 13.762s
> >  Invocation: 9e8c3dc015d64454810ba837d4433547
> > TriggeredBy: ○ ssh-agent.socket
> >        Docs: man:ssh-agent(1)
> >    Main PID: 3932465 (code=exited, status=2)
> >    Mem peak: 1.9M
> >         CPU: 24ms  
> 
> OK, this is just telling me that you aren't using the systemd unit any
> more, right?

Here is what I did to disable my non-systemd-managed agent and run it again
through systemd:
killall ssh-agent
systemctl --enable ssh-agent.service ssh-agent.socket
systemctl --user start ssh-agent.service

Here is the new output of `systemctl --user status ssh-agent.socket
ssh-agent.service`:

○ ssh-agent.socket - OpenSSH Agent socket
     Loaded: loaded (/usr/lib/systemd/user/ssh-agent.socket; enabled; preset: enabled)
     Active: inactive (dead)
   Triggers: ● ssh-agent.service
       Docs: man:ssh-agent(1)
     Listen: /run/user/1000/openssh_agent (Stream)

● ssh-agent.service - OpenSSH Agent
     Loaded: loaded (/usr/lib/systemd/user/ssh-agent.service; static)
     Active: active (running) since Thu 2025-05-08 17:11:05 CEST; 2min 9s ago
 Invocation: 4f8408f214414c46b1b5c1bac906a5cf
TriggeredBy: ○ ssh-agent.socket
       Docs: man:ssh-agent(1)
   Main PID: 3227523 (ssh-agent)
      Tasks: 1 (limit: 21468)
     Memory: 1.1M (peak: 2M)
        CPU: 23ms
     CGroup: /user.slice/user-1000.slice/[email protected]/app.slice/ssh-agent.service
             └─3227523 /usr/bin/ssh-agent -D

> >> How are you restarting the ssh-agent user service?  
> >
> > I used to restart it with:
> > systemctl --user restart ssh-agent.service  
> 
> Under what circumstances would you need to do this?  I'm not saying it's
> wrong (it should be fine!), i'm just trying to replicate the
> circumstances you found yourself in.

I only run that command when the agent is not running for some reason, like
what looked like a failure following the upgrade we are discussing. (it was not
a real failure, it’s only that the socket was no longer found where I expected
it to be)

> > But since I got bitten by the behaviour I reported, I stopped using the
> > systemd unit and now start the agent directly from my user ~/.profile:
> >
> > # Start SSH agent
> > export SSH_AUTH_SOCK="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/openssh_agent"
> > if [ ! -e "$SSH_AUTH_SOCK" ]; then
> > 	ssh-agent -a "$SSH_AUTH_SOCK" >/dev/null
> > fi
> >
> > For debugging purposes, I can disable that temporarily and get back to the
> > systemd unit, maybe try to get more debug output from it.  
> 
> Yes, please do try to disable that and see what you can replicate.  that
> would be great!  I'm unable to trigger the problem you described
> directly myself with the information we have so far.

Following the actions I listed above (disabling my workaround, re-enabling and
starting the systemd user units), I once again ended up with the socket created
in an unexpected path:
/tmp/ssh-Qyd6hMtI8ivT/agent.3227523
signature.asc (application/pgp-signature, 228 B)
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQSUsdxM90hewW6X7Jhja3j5HOuA2AUCaBzLLgAKCRBja3j5HOuA
2DPrAP0aCpF/GpWL94RmYRktVet+/J0WOk2Ysx1JsYymYq8xyAD/aPYQQqtKOPxy
LeAscFF4XcipYMQpZIwC56GCPWW9dws=
=a17q
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.