2

Yesterday, I unmasked a bug in Raspberry PI 3 and Ubuntu Mate 16.04 where the ssh-agent clobbers the LD_LIBRARY_PATH global environment variable which we wrote to /etc/environment using a bash script. The patch I made was to change use-ssh-agent to no-use-ssh-agent in /etc/X11/Xsession.options

What is the significance of X11 ssh-agent ?

  • It's under-documented, but it's not a bug; it's a consequence of proper security regarding the execution environment of ssh-agent: bugs.debian.org/cgi-bin/bugreport.cgi?bug=711623 – goldilocks Aug 27 '16 at 12:31
  • 1
    BTW, what you're doing could be considered a not-so-good practice (that link also explains why this happens; it's not peculiar to ssh-agent). If you really need to permantently add to the global system linker path, you should add an entry to the cache (see man ldconfig and examples in /etc/ld.so.conf.d). If all you need to do it for is a few particular applications, you should use shell wrappers and set LD_LIBRARY_PATH there. This is a more correct way to go whether or not you need ssh-agent; the same issue can bite you other ways. – goldilocks Aug 27 '16 at 12:40
  • @goldilocks, Thank you for your great comment. Instead of ldconfig and adding a file to /etc/ld.so.conf.d , could I add the following to the end of $HOME/.bashrc: for line in $( cat /etc/environment) do export line end – Frank Aug 27 '16 at 12:47
  • The (less serious) problem with pre/appending stuff to paths in .bashrc is it will tend to get run recursively, if an interactive shell is the child of another interactive shell, so, e.g., PATH=/foo/bar:$PATH can end up creating paths like /foo/bar:/foo/bar:/foo/bar:/bin:.... Beyond becoming env clutter that doesn't matter very much, but another issue – goldilocks Aug 27 '16 at 12:55
  • ...is that things spawned, e.g., by init services will never source .bashrc (see INVOCATION near the top of man bash) and very possibly that includes GUI login sessions (just you won't notice it in a terminal, because that is within an interactive shell). Also, if relevant you are relying on all users using bash as their default shell, which may not be the case. – goldilocks Aug 27 '16 at 12:56
3

Good place to start is manual page for the configuration file you are modifying: Xsession.options(5)

It clearly explains what the option use-ssh-agent means with appropriate references to all the other unknown terms for you:

use-ssh-agent

If the ssh-agent(1) program is available and no agent process appears to be running already, the X session will be invoked by exec'ing ssh-agent with the startup command, instead of the startup command directly.

In short, I would say that this option controls whether a ssh-agent is automatically started for you X11 sessions or not.

| improve this answer | |
  • Thank you for your excellent answer. May I ask what ssh has to do with X11? Also, why is it called ssh-agent instead of ssh-server? – Frank Aug 27 '16 at 12:06
  • 1
    You can find what is ssh-agent in its manual page. It is certainly not a ssh server (sshd is). SSH can do X11 forwarding, but it is not related in this context. In this context, as I explained in the answer, graphical sessions (X11) starts ssh-agent so you do not have to start it on your own and do not have to write passphrase for every ssh connection using encrypted keys. – Jakuje Aug 27 '16 at 12:09
  • ssh-agent is like a management tool for the ssh client, but if you aren't using it you don't need it (although as per my comment on the Q setting LD_LIBRARY_PATH globally still is not very wise). – goldilocks Aug 27 '16 at 12:29
  • 1
    It doesn't. But you may be using them. A mechanism ssh-agent seems to depend on is environment variables (env | grep SSH shows some for the process PID and a local socket address). Those are passed parent to child, and not vice versa or between cousins, etc. So to use the environment that way a process must be a direct descendant of whatever set it so; since authentication agents are things people commonly want to use with a desktop session, it's started along with the desktop. You can then use ssh-add within it and it applies to the session's agent. – goldilocks Aug 27 '16 at 13:23
  • 1
    That's kind of a big question you should ask separately. Also, I'm unlikely to be any help with it as I'm not a Ubuntu fan (not because I think there's anything wrong with it but because I prefer other distros). – goldilocks Aug 27 '16 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.