wez with agent forwarding

[flavius]

So I have the agent started, key loaded, ssh-add -L shows it.

Now I want to connect to a remote wez ssh host and keep my agent around.

with other emulators it works and I think I could make it work also with tmux upon rea-attaching.

I also have ForwardAgent yes in my .ssh/config and logging in to the server and doing ssh-add -L shows the key also.

The issue is then How can I get forwarding to work with ssh multiplexing/domains?

My current config:

local wezterm = require 'wezterm';

return  {
  disable_default_key_bindings = true,

  font_size = 10,

  leader = {key="a", mods="CTRL", timeout_milliseconds=1000},
  keys = {
    { key="L", mods="LEADER", action="ShowLauncher"},
    { key="c", mods="LEADER", action=wezterm.action{SpawnTab="CurrentPaneDomain"}},
    { key="t", mods="LEADER", action=wezterm.action{SpawnTab={DomainName="controller"}}},
    { key="u", mods="LEADER", action=wezterm.action{SpawnCommandInNewTab={
      -- args={"sudo", "bash", "--rcfile", "development/bin/activate", "-r"},
      args={"bash"}, -- HERE I need the agent to be forwarded
      domain={DomainName="controller"},
      cwd="/home/flaasp/unnamed/unnamed-master",
      set_environment_variables = {
        TEST = "a value"
      },
    }}},
  },
    ssh_domains = {
    {
      -- This name identifies the domain
      name = "controller",
      -- The address to connect to
      remote_address = "controller",
      -- The username to use on the remote host
      username = "flaasp",
    },
    unix_domains = {
      {
        name = "tunnels",
        connect_automatically = false,
      },
    },
  }
}

I marked the relevant line above with HERE I need the agent to be forwarded

In the code, I could find:

wezterm/wezterm-mux-server/src/main.rs

Lines 130 to 146 in c22765c

	// Remove some environment variables that aren't super helpful or
	// that are potentially misleading when we're starting up the
	// server.
	// We may potentially want to look into starting/registering
	// a session of some kind here as well in the future.
	for name in &[
	"OLDPWD",
	"PWD",
	"SHLVL",
	"SSH_AUTH_SOCK",
	"SSH_CLIENT",
	"SSH_CONNECTION",
	"_",
	] {
	std::env::remove_var(name);
	}

wezterm/wezterm-ssh/src/config.rs

Lines 524 to 528 in ba42367

	if !result.contains_key("identityagent") {
	if let Some(sock_path) = self.resolve_env("SSH_AUTH_SOCK") {
	result.insert("identityagent".to_string(), sock_path);
	}
	}

Which makes me believe it's not possible?

[wez]

libssh2 doesn't properly implement support for agent forwarding:

c6cd1a6

Until it does, wezterm is also unable to provide agent forwarding.

[barisozdag]

I think that time has come: libssh2/libssh2#535 (comment)

[carlesso]

Poking at this, the libssh2 issue seems addressed, is this unblocked now?

[amsesk]

I am also very interested in this. Lack of agent forwarding is the only thing keeping me on kitty/tmux for now.

[wez]

as of 4af418f, the mux server now automatically maintains SSH_AUTH_SOCK based on the most recently active multiplexer client. There have been additional commits to enable agent forwarding, if your ssh config enables it, for ssh domains.

[rgwood]

FYI this commit seems to have broken the use of ssh-agent on Windows (I noticed on latest main and bisected).

Repro steps:

1. Set ssh_backend = "Ssh2 to get the agent working as per this discussion
2. Try running ssh-add, get a "Error connecting to agent: No such file or directory" error

I've noticed that my SSH_AUTH_SOCK env var is set to something like C:\Users\reill\.local/share/wezterm\agent.3568 after that commit, but unsetting it doesn't fix the issue.

It's late here but I can create an issue tomorrow if that would be helpful.

edit: after reading through the commit, I was able to set mux_enable_ssh_agent = false to fix this

[Jaykul]

Yeah, I agree, I just recently switched to nightly wezterm, and this broke my earthly builds. I started getting:

Error: ssh agent provider: CreateFile C:\Users\Jaykul.local/share/wezterm\agent.30328: The file cannot be accessed by the system.

I normally use KeeAgent in KeePass for my ssh agent, but I have it configured to enable the agent for Windows' OpenSSH and create a WSL-compatible socket file (which has been working fine with WSL2)....