1

I have a public-private key pair at ~/.ssh being used for SSH connection to GitHub.

In order to test if I've setup SSH with GitHub properly, I used ssh -T [email protected], which works fine.

Also, If I execute the above command as superuser, it works fine.

su
ssh -T [email protected]

However, when I use sudo, the command isn't working. I suspect it's not able to access the key pair stored at ~/.ssh when run with sudo

The command below fails.

sudo ssh -T [email protected]

You can easily replicate the issue with any Ubuntu distribution and this GitHub help page.

Edit :

I understand that I can pass the private key to ssh as follows:

ssh -i <path-to-private-key> -T [email protected]

I'm just wondering why using sudo ssh -T [email protected] makes the private key inaccessible.

2 Answers 2

1

Hypothesis: there's an authentication agent running for your regular user and the agent holds the key.

ssh spawned from a non-elevated shell inherits the crucial environment variable SSH_AUTH_SOCK that tells it the location of the socket to communicate with the agent. ssh is able to use the agent, this is how you normally use an agent.

su does not unset the variable. ssh after su is able to locate the socket thanks to the variable. Normally the socket cannot be accessed by users other than the owner, but now ssh runs as root and root can access (almost) any file regardless of its permissions.

sudo does unset the variable (by default; see this and that). ssh in sudo ssh … is not able to locate the socket. It's like the agent wasn't there. ssh tries to find the right private key in few default locations in ~/.ssh, but now it checks in the root's home directory, not in your regular user's home directory where the right private key is.

0

You can pass the path to your identity file with the -i option to ssh.

ssh user@host -i /path/to/keyfile
1
  • Yes, this works. I'm just wondering why using sudo makes the private key inaccessible. Oct 14, 2015 at 17:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .