Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to ssh into a machine (let's call it B) from a machine (let's call it A), and then run a command on that machine (B) that would usually require entering an ssh passphrase (if you're interested, I'm trying to git pull from a private repository on BitBucket).

I can ssh into B from A (without entering a passphrase), and can run commands on that machine, like this:

A > ssh B 'ls'

I can also ssh into B from A, and run my git pull, and it asks for a passphrase:

A > ssh B
B > git pull
Enter passphrase for key '/home/username/.ssh/id_rsa': 

However, if I try a git pull (which would require a passphrase), this happens:

A > ssh cbc 'git pull'
Permission denied (publickey).
fatal: The remote end hung up unexpectedly

Any idea how I can get git pull working without a passphrase from A on B?

share|improve this question
up vote 5 down vote accepted

Set up ssh-agent (or equivalent), then enable agent forwarding for SSH connections.

Enable ssh-agent on your local machine

"Local" being the one you're sitting at. You should not need to run the agent anywhere else.

If you're lucky, one will be already running; most Linux distributions start an instance for every X11 session. Run ssh-add to import your keys; ssh-add -l to list keys.

If using GNOME or Mac OS X, you will probably have their own agent implementation, which imports known keys on login. With the standard OpenSSH ssh-agent, though, you have to do this manually (although scripts and PAM modules exist to automate).

On Windows, PuTTY comes with Pageant, and Cygwin OpenSSH with the same ssh-agent (although much more complicated to use than in Unix).

Enable agent forwarding

Once you have the agent working and keys loaded, try to connect like this:

A> ssh-add -l

A> ssh -A B ssh-add -l

The -A option enables agent forwarding over the SSH connection, so if everything works right, both commands above should give identical output.

$ ssh-add -l
2048 06:b7:29:1e:6b:ea:c3:04:c4:33:fc:48:e0:62:2f:ef grawity@anywhere (old key) (RSA)
4096 19:3c:f0:79:32:00:fa:04:2f:15:5d:2a:e2:c9:a3:ad grawity@anywhere (2011-11-01) (RSA)

$ ssh panther ssh-add -l
Could not open a connection to your authentication agent.

$ ssh -A panther ssh-add -l
2048 06:b7:29:1e:6b:ea:c3:04:c4:33:fc:48:e0:62:2f:ef grawity@anywhere (old key) (RSA)
4096 19:3c:f0:79:32:00:fa:04:2f:15:5d:2a:e2:c9:a3:ad grawity@anywhere (2011-11-01) (RSA)

If it works, make it persistent by editing ~/.ssh/config – put this at the bottom:

Host *
    ForwardAgent yes

Instead of * you can give a list of trusted names; see manual page of ssh_config for exact syntax.

You can enable forwarding on all machines; there is no limit to how much you can chain.

share|improve this answer
Fantastic - thanks! Everything worked first time (except when I typed ssh -A B without thinking to substitute the real hostname...). – Dominic Rodger Dec 30 '11 at 19:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.