# Can Ansible/Paramiko do agent forwarding? **URL:** \ **Category:** Ansible Project\ **Created:** [August 21, 2013, 6:56pm UTC](https://forum.ansible.com/t/can-ansible-paramiko-do-agent-forwarding/13343 "2013-08-21T18:56:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![David\_Minor](https://avatars.discourse-cdn.com/v4/letter/d/b38774/32.png) [@David\_Minor](https://forum.ansible.com/u/David_Minor)\ **Post date:** [August 21, 2013, 6:56pm UTC](https://forum.ansible.com/t/can-ansible-paramiko-do-agent-forwarding/13343/1 "2013-08-21T18:56:11Z")
It didn’t seem to work for me. Paramiko may have this ability, according to this: [https://github.com/paramiko/paramiko/pull/21](https://github.com/paramiko/paramiko/pull/21) ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [August 22, 2013, 3:56am UTC](https://forum.ansible.com/t/can-ansible-paramiko-do-agent-forwarding/13343/2 "2013-08-22T03:56:32Z")
Hmm, nice to see this has been added. I’m not sure what enabling it takes, but it would probably be an option, as agent forwarding is not something we should enable by default. I am fine with additions to make this an option. If you do “-c ssh” you can of course leverage OpenSSH to do that today, and “-c ssh” is the default on platforms that at least support ControlPersist (so it’s fast enough to not need paramiko) ---
**Author:** ![David\_Minor](https://avatars.discourse-cdn.com/v4/letter/d/b38774/32.png) [@David\_Minor](https://forum.ansible.com/u/David_Minor)\ **Post date:** [August 22, 2013, 4:10pm UTC](https://forum.ansible.com/t/can-ansible-paramiko-do-agent-forwarding/13343/3 "2013-08-22T16:10:37Z")
Yeah, I’m on centos, but I may switch to ubuntu for the newer ssh. Agent forwarding makes remote-\>remote so much cleaner. ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [September 12, 2013, 8:49pm UTC](https://forum.ansible.com/t/can-ansible-paramiko-do-agent-forwarding/13343/4 "2013-09-12T20:49:45Z")
Hello, I should be able to wrap up a patch adding agent forwarding to paramiko connection plugin in the next few days. can you Michael choose an option name that would sound good to you (knowing that these options would be specific to paramiko since -c ssh configures this via ANSIBLE\_SSH\_ARGS) There could be three levels of configurability for this thing because 3 different modifications are needed : - (1) remote user can use keys : need to use the paramiko AgentRequestHandler mechanism I have a working patch for this that I need to wrap up once the option name is chosen - (2) remote sudo\_user=root can use keys either leave that to the sudoers configuration (Defaults env\_keep+=SSH\_AUTH\_SOCK) or have ansible export the remote user SSH\_AUTH\_SOCK variable since root can always access $SSH\_AUTH\_SOCK (usually /tmp/ssh-\*) it works 🙂 - (3) remote sudo\_user!=root can use keys sudo\_user must be given permissions on $SSH\_AUTH\_SOCK by the remote user otherwise it won’t work. I don’t quite have a pretty solution on this one. Either give wild permission on $SSH\_AUTH\_SOCK or use setfacl where available to limit the permission to setfacl -m otheruser:x $(dirname “$SSH\_AUTH\_SOCK”) setfacl -m otheruser:rwx “$SSH\_AUTH\_SOCK” Do you want these 3 progressive levels of forwarding as 3 different options or just one big option that forwards at all levels ? Note that in option 3, giving permissions on the $SSH\_AUTH\_SOCK file may be considered dangerous by some people because all the users having permissions on $SSH\_AUTH\_SOCK are then able to use the forwarded keys. I am not a security expert so I would be glad to hear about what seems like an acceptable solution for this problem. Thanks ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [September 12, 2013, 10:02pm UTC](https://forum.ansible.com/t/can-ansible-paramiko-do-agent-forwarding/13343/5 "2013-09-12T22:02:11Z")
I’m ok with it being a configuration option in the [paramiko] section. agent\_forwarding=True/False/root ? Needs to enforce the following though – It should not break on older paramikos if disabled and should warn about incompatiblity on older paramikos if so enabled. ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [September 13, 2013, 10:36am UTC](https://forum.ansible.com/t/can-ansible-paramiko-do-agent-forwarding/13343/6 "2013-09-13T10:36:52Z")
Hello, here is a pull request adding agent forwarding to paramiko : [https://github.com/ansible/ansible/pull/4100](https://github.com/ansible/ansible/pull/4100) I hope it meets your expectations on the ‘progressive enhancement’ aspect of things. the options values are described in the pr. If the implementation is considered acceptable, note that the sudo/sudo\_user part could be ported to the ssh plugin. attribution to where it belongs: part of the code was inspired by the work of Lory Hochstein on the ssh transport mentioned here - [https://groups.google.com/forum/#!searchin/ansible-project/agent$20forwarding/ansible-project/cw8Sr9UvvQc/PGAxJaaAY4YJ](https://groups.google.com/forum/#!searchin/ansible-project/agent$20forwarding/ansible-project/cw8Sr9UvvQc/PGAxJaaAY4YJ) ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [September 13, 2013, 1:31pm UTC](https://forum.ansible.com/t/can-ansible-paramiko-do-agent-forwarding/13343/7 "2013-09-13T13:31:02Z")
We can continue discussion on the pull request. Thanks.