# How to automatically add a protected key to ssh-agent on startup?

I am using gdm to start awesome wm via .xinitrc. I like awesomes usability and gnomes integrity and so far most of the startup programs work fine but i am fighting with ssh-agent. When starting gnome my password protected id_rsa is automatically added to ssh-agent on startup.. i am trying to achive the same with my .xinitrc started awesome wm.

My .xinitrc:

/usr/libexec/at-spi-registryd &
gnome-screensaver &
/usr/libexec/vino-server --sm-disable &
/usr/bin/gnome-keyring-daemon --start --components=keyring &
/usr/bin/gnome-keyring-daemon --start --components=secrets &
/usr/bin/gnome-keyring-daemon --start --components=ssh &
/usr/bin/gnome-keyring-daemon --start --components=pkcs11 &
/usr/bin/gnome-keyring-daemon --start --components=gpg &
/usr/libexec/polkit-gnome-authentication-agent-1 &
/usr/libexec/evolution/2.32/evolution-alarm-notify &
/usr/libexec/gnome-settings-daemon &
gnome-power-manager &
gsettings-data-convert &
gnome-volume-control-applet &
nm-applet --sm-disable &
exec /usr/bin/ck-launch-session /usr/bin/dbus-launch --exit-with-session /usr/bin/ssh-agent -- awesome


How does Gnome tackle this?

-

GNOME stores your SSH key passphrases in GNOME Keyring, which (the login keyring) is unlocked with your login password by pam_gnome_keyring:

#%PAM-1.0
auth           ...
auth           ...
auth           optional        pam_gnome_keyring.so

session        ...
session        ...
session        optional        pam_gnome_keyring.so auto_start


However, your current setup will not work with this, as you are starting a ssh-agent at the last step, overwriting any environment variables that gnome-keyring may have set. Remove ssh-agent, and try adding this after all keyring daemon processes:

eval $(gnome-keyring-daemon --start)  Keep in mind also that gnome-keyring-daemon publishes a few environment variables over DBus which are then read by gnome-shell, which Awesome doesn't do. That, and you are starting the DBus session bus after all daemons have started, so they may be unable to connect to your session at all. One more thing: Many of the daemons must be started inside a ConsoleKit session – the PolicyKit authentication agent, for example. You'll have more luck if you replace your entire ~/.xinitrc script with: exec ck-launch-session dbus-launch --exit-with-session ~/.xinitrc-session  then use ~/.xinitrc-session to launch the rest of GNOME. You can go an easier way. Use the standard ck-launch-session dbus-launch --exit-with-session gnome-session, and just tell GNOME session manager to launch Awesome as the window manager. Follow the official instructions. Abridged form for GNOME 2: mkdir -p ~/.local/share/applications/ cp /usr/share/applications/awesome.desktop ~/.local/share/applications/ cat >> ~/.local/share/applications/awesome.desktop X-GNOME-WMName=Awesome X-GNOME-WMSettingsModule=awesome X-GNOME-Autostart-Phase=WindowManager;Panel X-GNOME-Provides=windowmanager;panel X-GNOME-Autostart-Notify=true [Ctrl-D] gconftool-2 --set /desktop/gnome/session/required_components/windowmanager --type string awesome  - Very nice answer. Does all this work the same way in Gnome 2 & 3? – Benjamin Bannier Jul 20 '11 at 18:44 @honk: GNOME 3 uses the same Keyring (first part), but handles the session stuff (second part) somewhat differently. The Awesome wiki page has instructions for both. – grawity Jul 20 '11 at 18:46 as it turned out ssh-agent is started by gdm before .xinitrc is run. eval$(gnome-keyring-daemon --start) before execing awesome did the trick so there realy where just the environment variables missing. thanks for pushing me in the right direction. –  matthias krull Jul 20 '11 at 20:35
@mugen: I hope you did read the entire post, not just the first ⅓. –  grawity Jul 20 '11 at 21:49
Of course i did. Using awesome as Gnome windowmanager did usually work with the instructions from the awesome wiki but did not recently. .xinitrc is executed via /usr/bin/dbus-launch --exit-with-session /usr/bin/ssh-agent -- /etc/X11/gdm/Xsession custom. So a DBus session and ssh-agent are allready running. For consolekit dependent programs like nm-applet to work i did not have to do anything else than launch awesome itself inside a console kit session. The environment variables realy were the missing part. –  matthias krull Jul 21 '11 at 6:06

Is there any particular reason not to use pam_ssh? I'm finding it rather convenient.

-
I have everything running with software that is pulled in as dependencies anyway. In the end there was a single line missing. So there was no reason to use another piece of software. But thanks for mentioning it, I will definitely take a closer look at it. –  matthias krull Aug 24 '11 at 23:39
Last time I used pam_ssh, it crashed and burned upon trying to import an ECDSA key, leaving me unable to login. (Admittely, gnome-keyring does not support it either, but at least it fails gracefully.) –  grawity Dec 1 '11 at 23:00