Extract SSH_AUTH_SOCK from SSHKeychain (OS X)

[adrianh]

I use the handy app SSHKeychain on my OS X box, which handles my SSH agent for me in various useful ways. The only problem is that the environment doesn't get set up properly for things like cron (since SSHKeychain stores it's socket info in a .plist).

This little snipped enables me to do things like:

with-sshkeychain svk sync -a 2>&1 | mail -s svk-sync-all adrianh

in my crontab and still get a connection to the SSHKeychain run ssh-agent. Super.

#! /usr/local/bin/perl

# with-sshkeychain SOME OTHER COMMAND

use Mac::PropertyList;

my $plist =
  Mac::PropertyList::parse_plist_file(
    "$ENV{ HOME }/.MacOSX/environment.plist" )
  or die "cannot parse environment.plist\n";

$ENV{ SSH_AUTH_SOCK } = $plist->value( 'SSH_AUTH_SOCK' )
  or die "no SSH_AUTH_SOCK\n";

exec( @ARGV );

[Fletch]

Of course since SSHKeychain always tends to use /tmp/$UID/SSHKeychain.socket (as long as I've been using it) one could probably safely hard code that in the crontab instead.

[jasonk]

Since the path is an option in the preferences, you can definitely safely hardcode it, as long as it matches what is in the preferences.

[Anonymous Monk]

Thanks for the comments above. The key was to set the SSH_AUTH_SOCK variable at the head of the file. I have no use for the sexy perl code, though, since I will keep this constant. I can now run cron jobs authorized with SSHKeychain using the following crontab:

SSH_AUTH_SOCK=/tmp/501/SSHKeychain.socket
0 15 * * 1-5 /usr/bin/backup

[jasonk]

You could also just go into the SSHKeychain preferences and check the box that says 'Manage (and modify) global environment variables', so that it will set $SSH_AUTH_SOCK for you.

[adrianh]

You could also just go into the SSHKeychain preferences and check the box that says 'Manage (and modify) global environment variables', so that it will set $SSH_AUTH_SOCK for you.

Erm. No. The whole point is that the way that SSHKeychain manages the environment (via the  .MacOSX/environment.plist in your home directory) doesn't propagate to some things like cron which are independent of your login.