How to get only remote git operations to trigger a ssh-add event for ssh-agent?

Question

I recently asked a question on AskUbuntu about getting ssh-agent to automatically save my passphrase protected key for later re-use without having to re-enter the passphrase during bash login (non-GUI/Gnome). I got a nice bash script in response, but unfortunately it is triggered to ask for the passphrase no matter the git operation. I only want to be prompted if they key is not already in ssh-agent and a remote git operation is being performed.

This is due to the fact that I use $(__git_ps1 "[%s]") in my bash prompt to display the git branch of the current working directory (pwd). So when I ssh into the machine it immediately asks me for the keys passphrase before it can render the bash prompt!

The current script from the answer to my question on AskUbuntu looks like:

In ~/.bash_profile:

# File: ~/.bash_profile

# source ~/.profile, if available
if [[ -r ~/.profile ]]; then
  . ~/.profile
fi

# start agent and set environment variables, if needed
agent_started=0
if ! env | grep -q SSH_AGENT_PID >/dev/null; then
  echo "Starting ssh agent"
  eval $(ssh-agent -s)
  agent_started=1
fi

# ssh become a function, adding identity to agent when needed
ssh() {
  if ! ssh-add -l >/dev/null 2>-; then
    ssh-add ~/.ssh/id_dsa
  fi
  /usr/bin/ssh "$@"
}
export -f ssh

# another example: git
git() {
  if ! ssh-add -l >/dev/null 2>-; then
    ssh-add ~/.ssh/id_dsa
  fi
  /usr/bin/git "$@"
}
export -f git

So as you can see the git function is triggered on every git operation.

I had thought that git would use ssh to make the connection, but it doesn't appear to trigger the ssh() function in the above script. How does git perform its ssh operations? Does it access /usr/bin/ssh directly rather than relying on the bash path?

Have you got a better way of doing this or a nice workaround for the current script?

The git executable /usr/bin/git is not written in bash (AFAIK) and so there is no reason for it to execute your ssh function. — nhed
@nhed that was my hypothesis. I wonder if I can replace /usr/bin/ssh with a bash ssh wrapper script so that it would be triggered? — Treffynnon
sounds dangerous, the git man-page mentions an env variable GIT_SSH - make that point to a wrapper - that may work cleaner. Give that a shot — nhed

drizzd drizzd · Accepted Answer · 2011-04-26T16:19:51

You can use agent forwarding even if you ssh into multiple hosts recursively. When ssh asks for a key for the first time, your local agent runs $SSH_ASKPASS and forwards the unlocked key to the host. Note that you have to enable agent forwarding (see man 5 ssh_config).

In ~/.ssh/config enable forwarding for each individual host you require:

Host example.org
    ForwardAgent yes

On the server side agent forwarding is enabled by default.

If you do not want to use agent forwarding for some reason, then I think overriding the ssh command is your only option.

How to get only remote git operations to trigger a ssh-add event for ssh-agent?

2 Answers