KDE graphical apps do not respect keyring / ssh-agent added via keychain (keychain works in shell correctly)

I migrated to a new computers along with my SSH keys. I have installed keychain, set it up correctly to load the keys.

However, now graphical KDE apps ask for password (e.g. for Git) and do not respect keys added via keychain in shell / terminal.

I see this in terminal:

* keychain 2.8.5 ~ http://www.funtoo.org
* Found existing ssh-agent: 142966
* Known ssh key: /home/xxx/.ssh/id_rsa
* Known ssh key: /home/xxx/.ssh/github_rsa
* Known ssh key: /home/xxx/.ssh/id_rsa.work

However, that seems to be incorrect as two processes are running with different pids:

ps aux | grep ssh-agent
xxx      2307  0.0  0.0 162652  6964 ?        Ssl  mar26   0:00 /usr/libexec/gcr-ssh-agent --base-dir /run/user/1000/gcr
xxx    144071  0.0  0.0   8304  1468 ?        Ss   10:44   0:00 ssh-agent -s
xxx    144125  0.0  0.0   8436  3632 ?        Ss   10:44   0:00 ssh-agent
xxx    144626  0.0  0.0   9212  2140 pts/5    S+   10:49   0:00 grep --color=auto ssh-agent

I tried killing both, restarting etc., but graphical apps never accept keys added via keychain.

.bashrc contains:

keychain ~/.ssh/id_rsa ~/.ssh/github_rsa ~/.ssh/id_rsa.work

I also tried to configure SSH_AUTH_SOCK:

echo $SSH_AUTH_SOCK
/tmp/ssh-vt37l1auORoj/agent.144071

Again, this seems to be incorrect, there is not such a process anymore (after killed).

ls /tmp/ssh-*/agent.*
/tmp/ssh-SM7TDO6GPDMm/agent.144124  /tmp/ssh-vt37l1auORoj/agent.144070

(these also do not match pids currently running?!)

Everything run via terminal works without asking for a password.

What could be the issue?

You seem to be running both the gnome ssh agent and at least one copy of KDEā€™s?

I start mine with a systemd service and thereā€™s just the one:

> ps aux |rg ssh
pallasw+    6969  0.0  0.0   9072  6972 ?        Ss   19:51   0:00 /usr/bin/ssh-agent -D -a /run/user/1000/ssh-agent.socket
pallasw+   69420  0.0  0.0   8948  6480 pts/3    S+   23:18   0:00 rg --smart-case --no-ignore --hidden ssh

I can not remove gcr as it would break some of my apps that use gnome-keyring. I believe this is happening independently of that. I havenā€™t had that app (requiring gcr) installed before and still this was an issue.

Yeah, I can confirm. Killing gcr does not change anything. I have also tried to restart ssh-agent after killing gcr and nothing changes.

SSH_AUTH_SOCK points to non-existing ssh-agent pid.

ls /tmp/ssh-*/agent.*
/tmp/ssh-cxKJ50y1bONH/agent.152578  /tmp/ssh-SM7TDO6GPDMm/agent.144124  /tmp/ssh-vt37l1auORoj/agent.144070

$ ps aux|grep ssh
x    152579  0.0  0.0   8436  3620 ?        Ss   13:40   0:00 ssh-agent
x    152843  0.0  0.0   9212  2220 pts/5    S+   13:42   0:00 grep --color=auto ssh

These are pids that do not exist, there is no agent pid that actually is running.
Why is that?

I have no idea how well it will work or not, to have gnomeā€™s agent on KDE, let alone gnomeā€™s agent and KDEs agent simultaneously on KDE.

Iā€™ve seen it do this when itā€™s started improperly, and the first instance sets the socket path and then dies.

How are you starting it?

And what is the test that fails? (you mentioned that it works in the GUI, what is it that you do? ssh:// address in dolphin?)

It is started automatically on login via .bashrc same as it was on my previous computer.

I am testing via any graphical app such as Filezilla or Git Cola (git repos via SSH). None of these work seamlessly, but pop up a password input for each key.

This could be a difference in environment.

I havenā€™t used Bash in ages but in ZSH the ..zshrc is only read by interactive shells, e.g. in a terminal.
It is not read by the login shell and thus environment set by it will not be part of what the Plasma session ā€œseesā€.

You could check by running env > /tmp/env.txt in KRunner (ALT+F2) and then looking at that file.

1 Like

I see these two lines containing ssh:

GSM_SKIP_SSH_AGENT_WORKAROUND=true
SSH_AUTH_SOCK=/run/user/1000/gnupg/S.gpg-agent.ssh

So this is incorrect, right?

Yeh thatā€™s likely the problem. Unless youā€™ve got something very fancy there, and my powers of mental telepathy arenā€™t working.

As krake said, if you want Plasma to see it, you need to start it in a way that the var will be seen by Plasma. Putting it in bashrc means itā€™s only seen by that one shell. This is why youā€™re seeing multiple PIDs and multiple instances.

There are two commonly advised ways to do it. One is a systemd service, the other is a shell script in ~/.config/plasma-workspace/env directory. If you run a web search for ā€˜ssh-agent autostart KDEā€™, youā€™ll find examples.

1 Like

Sorry, I donā€™t see any good tutorials, only a bunch of forums with various results, mostly non-working or confused examples such as this:

This does not help.

I have created this file in ~/.config/plasma-workspace/env:

#!/bin/sh
keychain ~/.ssh/id_rsa ~/.ssh/github_rsa ~/.ssh/id_rsa.work

Will that work on SDDM/KDE login?

Relatable, sorry. My search engine threw up an AI answer for me at the top, but I know thereā€™s a lot about how this fails, out there.

It will work on KDE login but not SDDM - This is why I use a systemd service, but that being said, itā€™s harder and you probably donā€™t actually need that (turns out I donā€™t either) so I guess the env script is a good way to go.

When we say ā€˜it will workā€™ this command isnā€™t one Iā€™m familiar with, I just start ssh-agent, so YMMV. I took a look at the manpage and I see that it doesnā€™t actually set the environment var, but rather, outputs a shell script to a known location, such that subsequent shells can source that script to set the var for themselves. That, ainā€™t gonna get the result you want.

It seems like if you wanted to use that app, youā€™d follow the manual:

keychain is a manager for ssh-agent, typically run from ~/.bash_profile.

Note (relevant to krakeā€™s call above again) this is not .bashrc

When keychain is run, it checks for a running ssh-agent, otherwise it starts one. It saves the ssh-agent environment variables to ~/.keychain/${HOSTNAME}-sh, so that subsequent logins and non-interactive shells such as cron jobs can source the file and make passwordless ssh connections.

Source that file from that kwin env script.

I think? Honestly Iā€™ve never seen this app before. Iā€™m pretty sure that would work. The second part Iā€™m sure about because thatā€™s exactly right according to the manual. The first part Iā€™m not certain because Iā€™m not sure that the bash_profile will execute, and run keychain and create the shell script, prior to kwin attempting to source it? Probably.

Sorry, reading more, it seems like you could be using --eval with keychain, then it will output the commands to set the vars and you can run them with eval (this is more like how OG ssh-agent works). To steal an example from the Arch wiki you linked and meld it with the last command you showed:

eval $(keychain --eval --quiet ~/.ssh/id_rsa ~/.ssh/github_rsa ~/.ssh/id_rsa.work)

In the kwin env script, might do the trick.

Thanks, Iā€™ll check this option.

So, no. Putting that line in ~/.config/plasma-workspace/env/ssh-keys.sh made KDE to stop booting and SDDM login would be shown after some time again. I had to delete that file.

Iā€™ll have to leave keychain for shells and use something else for KDE.

in ~/.config/plasma-workspace/env:

A point of warning here. Scripts in there may be sourced by sh. On Ubuntu-derived, and I imagine debian-derived, systems this is dash; I donā€™t know what sh is on Manjaro. Any shebang is ignored, and if sh is not bash any bashisms cause the script to terminate silently.

1 Like

I am on Neon, but I think itā€™s the same. Hopefully Iā€™ll be able to find some solution to this as it is a bit annoying that KDE is unaware of ssh-agent running.

Thatā€™s not necessary, and wonā€™t really work very well. You just need to figure out how to start this application correctly. Just because this one first try wasnā€™t correct, doesnā€™t mean itā€™s time to give up.

Thanks @jlittle !!!

The $(...) is a bashism, so if youā€™re using some other shell, adjust accordingly. Eg something like:

eval `keychain --eval --quiet ~/.ssh/id_rsa ~/.ssh/github_rsa ~/.ssh/id_rsa.work)`

Try it in a normal terminal shell first and make sure it runs as expected.

I thought $(ā€¦) was POSIX. dash does it fine, but maybe some distroā€™s sh donā€™t.

Are you on a Wayland session?

Because I am on Neon as well but on X11 and here ssh-agent is started by the X session setup regardless of which desktop is being started and without any config of my own.

Yeh youā€™re right it is POSIX spec. Turns out they both are, nowā€¦ I am just confused.

I happened to be learning the linux shell when BASH was the new hotness and frequently replacing Bourne sh and we had to learn three different ways to do it depending on which version of which shell it was. The whole experience just left me going 'idk Iā€™ll just try the other one if one fails" :laughing: I thought you were trying to politely tell me Iā€™d screwed it up but I guess the original should work, too.

Based on what krake is saying though, it sounds like on Neon, ssh-agent is standard, so maybe trying to get keychain to work isnā€™t the best option.

Yes, I am running Wayland.