Bug 1874

Summary:	Cannot enable agent forwarding if persistent master connection exists with no forwarding
Product:	Portable OpenSSH	Reporter:	Josh Triplett <josh>
Component:	ssh	Assignee:	Assigned to nobody <unassigned-bugs>
Status:	CLOSED WONTFIX
Severity:	normal	CC:	djm
Priority:	P2
Version:	5.8p1
Hardware:	All
OS:	All

Description Josh Triplett 2011-03-03 06:55:20 AEDT

~$ ssh joshtriplett.org ssh-add -l
Could not open a connection to your authentication agent.
~$ ssh -A joshtriplett.org ssh-add -l
Could not open a connection to your authentication agent.

The second connection made use of the backgrounded master connection
opened by the first connection, which had not yet timed out.  Due to this issue, in order to use SSH agent forwarding, I need to end all SSH connections over that connection master, "ssh -O exit", and open a new master connection with agent forwarding.  Or, alternatively, I have to explicitly turn off connection sharing and turn on agent forwarding.

(Originally reported as http://bugs.debian.org/594307)

Comment 1 Damien Miller 2011-04-19 15:57:19 AEST

A single agent connection is shared for all sessions that use the same multiplexed connection (this is a limitation of the SSH protocol). I don't think it is unreasonable to require this be available when the connection is established. 

BTW, I just committed support for "ssh -O stop ..." to turn off multiplexing while keeping one's sessions alive. So, if you mess up and forget to forward your agent when using openssh-5.9 or greater, then you can try again without killing all your existing sessions.

Comment 2 Josh Triplett 2011-04-19 18:59:16 AEST

(In reply to comment #1)
> A single agent connection is shared for all sessions that use the same
> multiplexed connection (this is a limitation of the SSH protocol). I
> don't think it is unreasonable to require this be available when the
> connection is established. 

I didn't know about the limitation to a single agent connection.  That
seems like something worth extending the protocol to work around.
However, in the meantime it still seems like a feature to have the
ability to add an agent to a connection after establishing it,
assuming the original SSH had the agent available in its environment.

Comment 3 Damien Miller 2011-09-06 15:33:12 AEST

close resolved bugs now that openssh-5.9 has been released