1

I have a public-private key pair at ~/.ssh being used for SSH connection to GitHub.

In order to test if I've setup SSH with GitHub properly, I used ssh -T git@github.com, which works fine.

Also, If I execute the above command as superuser, it works fine. 

su
ssh -T git@github.com

However, when I use sudo, the command isn't working. I suspect it's not able to access the key pair stored at ~/.ssh when run with sudo

The command below fails.

sudo ssh -T git@github.com

You can easily replicate the issue with any Ubuntu distribution and this GitHub help page.

Edit :

I understand that I can pass the private key to ssh as follows:

ssh -i <path-to-private-key> -T git@github.com

I'm just wondering why using sudo ssh -T git@github.com makes the private key inaccessible.

Bharat Khatri
  • 111

2 Answers2

1

Hypothesis: there's an authentication agent running for your regular user and the agent holds the key.

ssh spawned from a non-elevated shell inherits the crucial environment variable SSH_AUTH_SOCK that tells it the location of the socket to communicate with the agent. ssh is able to use the agent, this is how you normally use an agent.

su does not unset the variable. ssh after su is able to locate the socket thanks to the variable. Normally the socket cannot be accessed by users other than the owner, but now ssh runs as root and root can access (almost) any file regardless of its permissions.

sudo does unset the variable (by default; see this and that). ssh in sudo ssh … is not able to locate the socket. It's like the agent wasn't there. ssh tries to find the right private key in few default locations in ~/.ssh, but now it checks in the root's home directory, not in your regular user's home directory where the right private key is.

Kamil Maciorowski
  • 81,893
0

You can pass the path to your identity file with the -i option to ssh.

ssh user@host -i /path/to/keyfile
brains_at_work
  • 291