4 Jun 2010 fab   » (Master)

gnome-keyring-daemon as an ssh-agent

The gnome-keyring-daemon is now a drop-in replacement for ssh-agent. Until recently, I faced with several situations where the daemon silently crashes and all the ssh keys already loaded in the agent are lost. The way I use ssh is quite intensive, for example I'm a big fan of pdsh, the command dedicated to launch a command to a group of machines in parallel. Every machine is reached via ssh, so the ssh agent is heavily solicited when pdsh is executed. I suspected some bad data structures locking in the agent, when accessed in a multi threaded environment, like it is the case for pdsh. I filled this bugzilla, and proposed a patch that works really nice for me.

However, if rebuilding the gnome-keyring package is not an option for you, it is still possible to recover the session, and to start a new instance of an ssh-agent. The problem is that each terminal shell has an environment variable, SSH_AUTH_SOCKET, that points to the defunct ssh agent. So, the key of the hack is to symlink the control socket from the new ssh-agent instance to the socket of the crashed gkd, add the ssh keys again into the new agent, and you're done.

[bellet@monkey ~]$ env | grep SSH
SSH_AUTH_SOCK=/tmp/keyring-v3d1mX/ssh
SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
[bellet@monkey ~]$ ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-TJfoGI5899/agent.5899; export SSH_AUTH_SOCK;
SSH_AGENT_PID=5900; export SSH_AGENT_PID;
echo Agent pid 5900;
[bellet@monkey ~]$ ln -sf /tmp/ssh-TJfoGI5899/agent.5899 /tmp/keyring-v3d1mX/ssh 
[bellet@monkey ~]$ ssh-add
Enter passphrase for /home/bellet/.ssh/id_dsa: 
Identity added: /home/bellet/.ssh/id_dsa (/home/bellet/.ssh/id_dsa)

Latest blog entries     Older blog entries