Is it possible to change the SSH_AUTH_SOCK path?

Question

I would like to have the ssh-agent socket inside my home directory, but currently it is created inside /private/tmp.

I see that the agent is managed though launchctl and this plist: /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist, but I don't know how to modify this file to have the socket, for example, at ~/.ssh-agent.sock.

Answer 1

I ended up with the following plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>org.openbsd.ssh-agent</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/bin/ssh-agent</string>
        <string>-l</string>
    </array>
    <key>Sockets</key>
    <dict>
        <key>Listeners</key>
        <dict>
            <!--
                 <key>SecureSocketWithKey</key>
                 <string>SSH_AUTH_SOCK</string>
            -->
            <key>SockPathName</key>
            <string>/Users/myusername/.ssh-agent.sock</string>
            <key>SockPathMode</key>
            <integer>384</integer> <!-- 0600b8 in decimal -->
            <key>SockPathGroup</key>
            <integer>0</integer>
        </dict>
    </dict>
    <key>EnvironmentVariables</key>
    <dict>
        <key>SSH_AUTH_SOCK</key>
        <string>/Users/myusername/.ssh-agent.sock</string>
    </dict>
    <key>EnableTransactions</key>
    <true/>
</dict>
</plist>

The only downside is the need for an hard coded username. If somebody know how to solve this as well...

I just overwrote the default file at /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist, then I executed the following commands:

launchctl unload /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist
launchctl load /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist
launchctl start org.openbsd.ssh-agent

Answer 2

I end up with a .bashrc script:

# Predictable SSH authentication socket location.
SOCK="$HOME/.ssh/agent_sock"
AGENT_ENV="$HOME/.ssh/agent_env"
if ! ps -x | fgrep -v fgrep | fgrep -q $SOCK;
then
    rm -f $SOCK
    ssh-agent -a $SOCK > $AGENT_ENV
fi
eval $(cat $AGENT_ENV)

And sounds like this wont work for GUI as well. Updating plist is too painful on El Capitan (Reboot to recovery & SIP disable -> reboot -> edit plist & test -> reboot to recovery & SIP enable -> reboot), so for those who is OK to have this solved for shell only - this is a working solution.

Answer 3

You could do this basically in two possible ways without tweaking plist files:

1. If you always use bash in the Terminal and you want to enable that, set the path to your socket global in /etc/bashrc for all users:

   export SSH_AUTH_SOCK=${HOME}/.ssh-agent.sock
   

2. Set the SSH_AUTH_SOCK variable in the user's .bashrc script. Same way as in no. 1.

So whenever a user logs in with the command-line and has bash executed, the user always has its AUTH Socket set in the home directory. You may have to do it for other shells in similar ways AND you always have to ensure that the agent directory exists. Of course I cannot guarantee that this will work with GUI clients aka CyberDuck as well.