Could not open a connection to your authentication agent

Question

I am running into this error of:

$ git push heroku master
Warning: Permanently added the RSA host key for IP address '50.19.85.132' to the list of known hosts.
!  Your key with fingerprint b7:fd:15:25:02:8e:5f:06:4f:1c:af:f3:f0:c3:c2:65 is not authorized to access bitstarter.

I tried to add the keys and I get this error below:

$ ssh-add ~/.ssh/id_rsa.pub
Could not open a connection to your authentication agent.

Answer 1

Did You Start ssh-agent?

You might need to start ssh-agent before you run the ssh-add command:

eval `ssh-agent -s`
ssh-add

Note that this will start the agent for msysgit Bash on Windows. If you're using a different shell or operating system, you might need to use a variant of the command, such as those listed in the other answers.

See the following answers:

1. ssh-add complains: Could not open a connection to your authentication agent
2. Git push requires username and password (contains detailed instructions on how to use ssh-agent)
3. How to run (git/ssh) authentication agent?.
4. Could not open a connection to your authentication agent

To automatically start ssh-agent and allow a single instance to work in multiple console windows, see Start ssh-agent on login.

Why do we need to use eval instead of just ssh-agent?

To find out why, see Robin Green's answer.

Public vs Private Keys

Also, whenever I use ssh-add, I always add private keys to it. The file ~/.ssh/id_rsa.pub looks like a public key, I'm not sure if that will work. Do you have a ~/.ssh/id_rsa file? If you open it in a text editor, does it say it's a private key?

Answer 2

I tried the other solutions to no avail. I made more research and found that the following command worked. I am using Windows 7 and Git Bash.

eval $(ssh-agent)

More information in: https://coderwall.com/p/rdi_wq

Answer 3

The following command worked for me. I am using CentOS.

exec ssh-agent bash

Answer 4

Could not open a connection to your authentication agent

To resolve this error:

bash:

$ eval `ssh-agent -s`

tcsh:

$ eval `ssh-agent -c`

Then use ssh-add as you normally would.

---

Hot Tip:

I was always forgetting what to type for the above ssh-agent commands, so I created an alias in my .bashrc file like this:

alias ssh-agent-cyg='eval `ssh-agent -s`'

Now instead of using ssh-agent, I can use ssh-agent-cyg

E.g.

$ ssh-agent-cyg
SSH_AUTH_SOCK=/tmp/ssh-n16KsxjuTMiM/agent.32394; export SSH_AUTH_SOCK;
SSH_AGENT_PID=32395; export SSH_AGENT_PID;
echo Agent pid 32395;
$ ssh-add ~/.ssh/my_pk

---

Original Source of fix:

http://cygwin.com/ml/cygwin/2011-10/msg00313.html

Answer 5

MsysGit or Cygwin

If you're using Msysgit or Cygwin you can find a good tutorial at SSH-Agent in msysgit and cygwin and bash:

1. Add a file called .bashrc to your home folder.

2. Open the file and paste in:

   #!/bin/bash
   eval `ssh-agent -s`
   ssh-add
   

3. This assumes that your key is in the conventional ~/.ssh/id_rsa location. If it isn't, include a full path after the ssh-add command.

4. Add to or create file ~/.ssh/config with the contents

   ForwardAgent yes
   

   In the original tutorial the ForwardAgent param is Yes, but it's a typo. Use all lowercase or you'll get errors.

5. Restart Msysgit. It will ask you to enter your passphrase once, and that's it (until you end the session, or your ssh-agent is killed.)

Mac/OS X

If you don't want to start a new ssh-agent every time you open a terminal, check out Keychain. I'm on a Mac now, so I used the tutorial ssh-agent with zsh & keychain on Mac OS X to set it up, but I'm sure a Google search will have plenty of info for Windows.

Update: A better solution on Mac is to add your key to the Mac OS Keychain:

ssh-add -K ~/.ssh/id_rsa

Simple as that.

Answer 6

Run

ssh-agent bash
ssh-add

To get more details you can search

ssh-agent

or run

man ssh-agent

Answer 7

ssh-add and ssh (assuming you are using the openssh implementations) require an environment variable to know how to talk to the ssh agent. If you started the agent in a different command prompt window to the one you're using now, or if you started it incorrectly, neither ssh-add nor ssh will see that environment variable set (because the environment variable is set locally to the command prompt it's set in).

You don't say which version of ssh you're using, but if you're using cygwin's, you can use this recipe from SSH Agent on Cygwin:

# Add to your Bash config file
SSHAGENT=/usr/bin/ssh-agent
SSHAGENTARGS="-s"
if [ -z "$SSH_AUTH_SOCK" -a -x "$SSHAGENT" ]; then
    eval `$SSHAGENT $SSHAGENTARGS`
    trap "kill $SSH_AGENT_PID" 0
fi

This will start an agent automatically for each new command prompt window that you open (which is suboptimal if you open multiple command prompts in one session, but at least it should work).

Answer 8

I faced the same problem for Linux, and here is what I did:

Basically, the command ssh-agent starts the agent, but it doesn't really set the environment variables for it to run. It just outputs those variables to the shell.

You need to:

eval `ssh-agent`

and then do ssh-add. See Could not open a connection to your authentication agent.

Answer 9

Instead of using $ ssh-agent -s, I used $ eval `ssh-agent -s` to solve this issue.

Here is what I performed step by step (step 2 onwards on GitBash):

1. Cleaned up my .ssh folder at C:\user\<username>\.ssh\
2. Generated a new SSH key
   $ ssh-keygen -t rsa -b 4096 -C "xyz@abc.com"
3. Check if any process id(ssh agent) is already running.
   $ ps aux | grep ssh
4. (Optional) If found any in step 3, kill those
   $ kill <pids>
5. Started the ssh agent
   $ eval `ssh-agent -s`
6. Added ssh key generated in step 2 to ssh agent
   $ ssh-add ~/.ssh/id_rsa

Answer 10

Try to the following steps:

1) Open Git Bash and run: cd ~/.ssh

2) Try to run agent : eval $(ssh-agent)

3) Right now, you can run the following command : ssh-add -l

Answer 11

In Windows 10 I tried all answers listed here but none of them seemed to work. In fact they give a clue. To solve a problem simply you need 3 commands. The idea of this problem is that ssh-add needs SSH_AUTH_SOCK and SSH_AGENT_PID environment variables to be set with current ssh-agent sock file path and pid number.

ssh-agent -s > temp.txt

This will save output of ssh-agent in file. Text file content will be something like this:

SSH_AUTH_SOCK=/tmp/ssh-kjmxRb2764/agent.2764; export SSH_AUTH_SOCK;
SSH_AGENT_PID=3044; export SSH_AGENT_PID;
echo Agent pid 3044;

Copy something like "/tmp/ssh-kjmxRb2764/agent.2764" from text file and run following command directly in console:

set SSH_AUTH_SOCK=/tmp/ssh-kjmxRb2764/agent.2764

Copy something like "3044" from text file and run following command directly in console:

set SSH_AGENT_PID=3044

Now when environment variables (SSH_AUTH_SOCK and SSH_AGENT_PID) are set for current console session run your ssh-add command and it will not fail again to connect ssh agent.

Answer 12

One thing I came across was that eval did not work for me using Cygwin, what worked for me was ssh-agent ssh-add id_rsa.

After that I came across an issue that my private key was too open, the solution I managed to find for that (from here):

chgrp Users id_rsa

as well as

chmod 600 id_rsa

finally I was able to use:

ssh-agent ssh-add id_rsa

Answer 13

For window users, I found cmd eval `ssh-agent -s` didn't work, but using git bash worked a treat eval `ssh-agent -s`; ssh-add KEY_LOCATION, and making sure the windows service "OpenSSH Key Management" wasn't disabled

Answer 14

To amplify on n3o's answer for Windows 7...

My problem was indeed that some required environment variables weren't set, and n3o is correct that ssh-agent tells you how to set those environment variables, but doesn't actually set them.

Since Windows doesn't let you do "eval," here's what to do instead:

Redirect the output of ssh-agent to a batch file with

ssh-agent > temp.bat

Now use a text editor such as Notepad to edit temp.bat. For each of the first two lines: - Insert the word "set" and a space at the beginning of the line. - Delete the first semicolon and everything that follows.

Now delete the third line. Your temp.bat should look something like this:

set SSH_AUTH_SOCK=/tmp/ssh-EorQv10636/agent.10636
set SSH_AGENT_PID=8608

Run temp.bat. This will set the environment variables that are needed for ssh-add to work.

Answer 15

I just got this working. Open your ~/.ssh/config file.

Append the following-

Host github.com
 IdentityFile ~/.ssh/github_rsa

The page that gave me the hint Set up SSH for Git said that the single space indentation is important... though I had a configuration in here from Heroku that did not have that space and works properly.

Answer 16

If you follow these instructions, your problem would be solved.

If you’re on a Mac or Linux machine, type:

eval "$(ssh-agent -s)"

If you’re on a Windows machine, type:

ssh-agent -s

Answer 17

I had the same problem on Ubuntu and the other solutions didn't help me. I finally realized what my problem was. I had created my ssh keys in /root/.ssh folder, So even when I ran ssh-add as root, it couldn't do its work and keep saying

Could not open a connection to your authentication agent.

I created my ssh public and private keys in /home/myUsername/ folder and I used

ssh-agent /bin/sh

then I ran

ssh-add /home/myUsername/.ssh/id_rsa

and problem was solved this way.

Note: For accessing your repository on git add your git password when you are creating ssh keys with ssh-keygen -t rsa -C "your git email here".

Answer 18

Let me offer another solution. If you have just installed Git 1.8.2.2 or thereabouts, and you want to enable SSH, follow the well-writen directions.

Everything through to Step 5.6 where you might encounter a slight snag. If an SSH agent is already be running you could get the following error message when you restart bash

Could not open a connection to your authentication agent

If you do, use the following command to see if more than one ssh-agent process is running

ps aux | grep ssh

If you see more than one ssh-agent service, you will need to kill all of these processes. Use the kill command as follows (the PID will be unique on your computer)

kill <PID>

Example:

kill 1074

After you have removed all of the ssh-agent processes, run the px aux | grep ssh command again to be sure they are gone, then restart Bash.

Voila, you should now get something like this:

Initializing new SSH agent...
succeeded
Enter passphrase for /c/Users/username/.ssh/id_rsa:

Now you can continue on Step 5.7 and beyond.

Answer 19

Note: this is an answer to this question, which has been merged with this one. That question was for Windows 7, meaning my answer was for Cygwin/MSYS/MSYS2. This one seems for some unix, where I wouldn't expect the SSH agent needing to be managed like this.

This will run the SSH agent and authenticate only the first time you need it, not every time you open your Bash terminal. It can be used for any program using SSH in general, including ssh itself and scp. Just add this to /etc/profile.d/ssh-helper.sh:

ssh-auth() {
    # Start the SSH agent only if not running
    [[ -z $(ps | grep ssh-agent) ]] && echo $(ssh-agent) > /tmp/ssh-agent-data.sh

    # Identify the running SSH agent
    [[ -z $SSH_AGENT_PID ]] && source /tmp/ssh-agent-data.sh > /dev/null

    # Authenticate (change key path or make a symlink if needed)
    [[ -z $(ssh-add -l | grep "/home/$(whoami)/.ssh/id_rsa") ]] && ssh-add
}

# You can repeat this for other commands using SSH
git() { ssh-auth; command git "$@"; }

Answer 20

Use parameter -A when you connect to server, example:

ssh -A root@myhost

from man page :

-A Enables forwarding of the authentication agent connection.  
   This can also be specified on a per-host basis in a configuration file.

   Agent forwarding should be enabled with caution.  Users with the ability to bypass file permissions on the remote host (for the agent's
   UNIX-domain socket) can access the local agent through the forwarded 
   connection.  An attacker cannot obtain key material from the agent,
   however they can perform operations on the keys that enable them to
   authenticate using the identities loaded into the agent.

Answer 21

The basic solution to run ssh-agent is answered in many answers. However runing ssh-agent many times (per each opened terminal or per remote login) will create a many copies ot ssh-agent running in memory. The scripts which is suggested to avoid that problem is long and need to write and/or copy separated file or need to write too many strings in ~/.profile or ~/.schrc. Let me suggest simple two string solution:

For sh, bash, etc:

# ~/.profile
if ! pgrep -q -U `whoami` -x 'ssh-agent'; then ssh-agent -s > ~/.ssh-agent.sh; fi
. ~/.ssh-agent.sh

For csh, tcsh, etc:

# ~/.schrc
sh -c 'if ! pgrep -q -U `whoami` -x 'ssh-agent'; then ssh-agent -c > ~/.ssh-agent.tcsh; fi'
eval `cat ~/.ssh-agent.tcsh`

What is here:

• search the process ssh-agent by name and by current user
• create appropriate shell script file by calling ssh-agent and run ssh-agent itself if no current user ssh-agent process found
• evaluate created shell script which configure appropriate environment

It is not necessary to protect created shell script ~/.ssh-agent.tcsh or ~/.ssh-agent.sh from another users access because: at-first communication with ssh-agent is processed through protected socket which is not accessible to another users, and at-second another users can found ssh-agent socket simple by enumeration files in /tmp/ directory. As far as about access to ssh-agent process it is the same things.

Answer 22

Try the following:

ssh-agent sh -c 'ssh-add && git push heroku master'

Answer 23

Read @cupcake's answer for explanations. Here I only try to automate the fix.

If you using Cygwin terminal with BASH, add the following to $HOME/.bashrc file. This only starts ssh-agent once in the first Bash terminal and adds the keys to ssh-agent. (Not sure if this is required on Linux)

###########################
# start ssh-agent for
# ssh authentication with github.com
###########################
SSH_AUTH_SOCK_FILE=/tmp/SSH_AUTH_SOCK.sh
if [ ! -e $SSH_AUTH_SOCK_FILE ]; then
    # need to find SSH_AUTH_SOCK again.
    # restarting is an easy option
    pkill ssh-agent
fi
# check if already running
SSH_AGENT_PID=`pgrep ssh-agent`
if [ "x$SSH_AGENT_PID" == "x" ]; then
#   echo "not running. starting"
    eval $(ssh-agent -s) > /dev/null
    rm -f $SSH_AUTH_SOCK_FILE
    echo "export SSH_AUTH_SOCK=$SSH_AUTH_SOCK" > $SSH_AUTH_SOCK_FILE
    ssh-add $HOME/.ssh/github.com_id_rsa 2>&1 > /dev/null
#else
#   echo "already running"
fi
source $SSH_AUTH_SOCK_FILE

DONT FORGET to add your correct keys in "ssh-add" command.

Answer 24

I had this problem, when I started ssh-agent, when it was already running. Gets confused. To see if this is the case, use

eval $(ssh-agent)

to see if this is the same as what you thought it should be. In my case, it was different than the one I just started.

To further verify if you have more than one ssh-agent running, you can review:

ps -ef | grep ssh

Answer 25

I had a similar problem when I was trying to get this to work on Windows to connect to stash via ssh

Here is the solution that worked for me.

1. Turns out I was running Pageant ssh agent on my Windows box - I would check what you are running. I suspect it is Pageant as it comes as default with Putty and winScp

2. The ssh-add does not work from command line with this type of agent

3. You need to add the private key via pageant UI window which you can get by doublicking the Pageant icon in the taskbar (once it is started).

4. Before you add the key to Pageant you need to convert it to PPK format. Full instructions are available here How to convert SSH key to ppk format

5. That is it. Once I uploaded my key to stash I was able to use SourceTree to create a local repo and clone the remote.

Hope this helps...

Answer 26

For bash built into Windows 10, I added this to .bash_profile:

if [ -z $SSH_AUTH_SOCK ]; then
    if [ -r ~/.ssh/env ]; then
            source ~/.ssh/env
            if [ `ps -p $SSH_AGENT_PID | wc -l` = 1 ]; then
                    rm ~/.ssh/env
                    unset SSH_AUTH_SOCK
            fi
    fi
fi

if [ -z $SSH_AUTH_SOCK ]; then
    ssh-agent -s | sed 's/^echo/#echo/'> ~/.ssh/env
    chmod 600 ~/.ssh/env
    source ~/.ssh/env > /dev/null 2>&1
fi

Answer 27

I resolved the error by force stopping (killed) git processes (ssh agent), then uninstalling Git, and then installing Git again.

Answer 28

Using Git Bash on Win8.1E, my resolution was as follows:

eval $(ssh-agent) > /dev/null
ssh-add ~/.ssh/id_rsa

Answer 29

If you are using Putty, perhaps you need to set the "Connection/SSH/Auth/Allow agent forwarding" option to "true".

Answer 30

This worked for me.

In the CMD window, type the following command:

cd path-to-Git/bin # (for example,cd C:\Program Files\Git\bin)
bash
exec ssh-agent bash
ssh-add path/to/.ssh/id_rsa

Answer 31

In Windows 10, using the Command Prompt terminal, the following works for me:

ssh-agent cmd 
ssh-add

You should then be asked for a passphrase after this:

Enter passphrase for /c/Users/username/.ssh/id_rsa:

Answer 32

Also check you remote url. use git@github... instead of https:// proptocol

see https://stackoverflow.com/a/33928364/551811

Answer 33

For PowerShell in Windows

I was having trouble with PoSH and the Start-SshAgent / Add-SshKey commands, so I whipped up a quick script that might help some folks out. This is intended to be added to your PowerShell profile which you can edit by executing notepad $PROFILE

if ($(Get-Process ssh-agent) -eq $null)
{
    $ExecutionContext.InvokeCommand.ExpandString($(ssh-agent -c).Replace("setenv", "set"));
}

It will detect if the ssh-agent is running or not and only execute if there is no agent running already. Please note that $ExecutionContext.InvokeCommand.ExpandString is a pretty dangerous command so you may not want to use this solution if you are using an untrusted copy of ssh-agent.

Answer 34

Here is the solution I came up with when using PowerShell.

Add the below function to your Microsoft.PowerShell_profile.ps1

function RunSsh($userIdentity ) {
   $agent=ssh-agent
   $position=$agent[0].IndexOf("=")
   $ending=$agent[0].IndexOf(";")

   $variableStartPosition=$agent[0].IndexOf("export")
   $variableEndPosition=$agent[0].LastIndexOf(";")
   $variableName=$agent[0].Substring($variableStartPosition+7,$variableEndPosition-$variableStartPosition-7)
   [Environment]::SetEnvironmentVariable($variableName, $agent[0].Substring($position+1,$ending-$position-1))

   $position=$agent[1].IndexOf("=")
   $ending=$agent[1].IndexOf(";")

   $variableStartPosition=$agent[1].IndexOf("export")
   $variableEndPosition=$agent[1].LastIndexOf(";")
   $variableName=$agent[1].Substring($variableStartPosition+7,$variableEndPosition-$variableStartPosition-7)
   [Environment]::SetEnvironmentVariable($variableName, $agent[1].Substring($position+1,$ending-$position-1))

   if($userIdentity.Length -eq 0) {
      ssh-add
   } else {
      ssh-add $userIdentity
   }
}

Now from the command line you can run RunSsh which uses identity file in ~\.ssh folder or pass in the identity file with RunSsh C:\ssh\id_rsa where C:\ssh\id_rsa is your identity file.

For this to work you need to have ssh-add and ssh-agent in your path environment variable.

Answer 35

Even I was getting "Could not open a connection to your authentication agent." on running the command while generating and adding SSH key: ssh-add ~/.ssh/id_rsa. I resolved it by stopping the multiple ssh-agent instances running on my machine and then uninstalled the Git from control panel on my windows machine and then again installed Git and things were working now.

Answer 36

In my case, my Comodo firewall had sandboxed the ssh agent. Once I disabled sandboxing I was able to clone the repository.

FYI, I am using Comodo firewall on Windows 7.

Answer 37

The easiest solution does not have to be bad.

You need neither ssh-agent nor ssh-add when you use a passwordless private key, see https://stackoverflow.com/a/48290333/11154841.

By this, I got rid of the error Could not open a connection to your authentication agent. ssh-add exit code 2.

That does not need to be insecure: you simply need to delete both keys of the key pair right after their usage. That means, you must delete the public key on the server and delete the private key on the client. It goes without saying: never use them again, do not even keep a backup somewhere.

Mind that you can create the public key from a private key, but not the other way round. Normally, it should suffice to simply delete the public key from the registered keys on your Git portal, but they should better be both deleted, so that the same public key can never ever be used again. Even if someone had stolen your private key, it would be of no use if you simply never use its public key again.

With a passwordless private key, you can even use it in Docker to get around any password entries. You can clone a git repo without any password, the passwordless private key is all you need. See Dockerfile: clone repo with passwordless private key. Errors: “authentication agent” or “read_passphrase: can't open /dev/tty” as an example.