# ssh-agent forwarding **URL:** \ **Category:** Ansible Project\ **Created:** [October 11, 2021, 5:04pm UTC](https://forum.ansible.com/t/ssh-agent-forwarding/35845 "2021-10-11T17:04:44Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Neil\_Young](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Neil\_Young](https://forum.ansible.com/u/Neil_Young)\ **Post date:** [October 11, 2021, 5:04pm UTC](https://forum.ansible.com/t/ssh-agent-forwarding/35845/1 "2021-10-11T17:04:44Z")
Hi, Trying since hours, can’t make it work (although it worked already somewhen)… OK. Having a public ssh key, say ~/.ssh/id\_rsa.pub. Configured it to Bitbucket. Able to checkout my project using public key authentication from bitbucket on my local machine. Was going to try that on an ansible node using ssh-agent forwarding. Running `ssh-add ~/.ssh/id_rsa` once. `ssh-add -l` shows 4096 SHA256:SpKY4tbbE7pkV5Ex3plKgu6X4nq6jtnM+Lss5Xk605A me@anywhere(RSA) As said, the same key is configured to bitbucket. My ./ansible.cfg: [ssh\_connection] ssh\_args=-o ForwardAgent=yes The playbook: ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [October 11, 2021, 5:07pm UTC](https://forum.ansible.com/t/ssh-agent-forwarding/35845/2 "2021-10-11T17:07:38Z")
Are you using become? If so, sudo by default will not pass the env var used for SSH\_AUTH\_SOCK. ---
**Author:** ![Neil\_Young](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Neil\_Young](https://forum.ansible.com/u/Neil_Young)\ **Post date:** [October 11, 2021, 5:10pm UTC](https://forum.ansible.com/t/ssh-agent-forwarding/35845/3 "2021-10-11T17:10:33Z")
Oh, strange. Maybe I know why it works. I must have tried that earlier too. On my node I tried to clone the project manually. Didn’t work of course. But on the way I was asked to add the bitbucket identity to the known hosts on my node. The authenticity of host ‘[bitbucket.org](http://bitbucket.org) (104.192.141.1)’ can’t be established. RSA key fingerprint is SHA256:zzXQOXSRBEiUtuE8AikJYKwbHaxvSc0ojez9YXaGp1A. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added ‘[bitbucket.org](http://bitbucket.org),104.192.141.1’ (RSA) to the list of known hosts. [git@bitbucket.org](mailto:git@bitbucket.org): Permission denied (publickey). In the end the local clone didn’t work, but after that step the above sequence worked from my control node… So I was able to clone the project from remote after having bitbucket as known host on the node… Makes sense? ---
**Author:** ![Neil\_Young](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Neil\_Young](https://forum.ansible.com/u/Neil_Young)\ **Post date:** [October 11, 2021, 5:11pm UTC](https://forum.ansible.com/t/ssh-agent-forwarding/35845/4 "2021-10-11T17:11:16Z")
No. become is not used ---
**Author:** ![Neil\_Young](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Neil\_Young](https://forum.ansible.com/u/Neil_Young)\ **Post date:** [October 11, 2021, 5:26pm UTC](https://forum.ansible.com/t/ssh-agent-forwarding/35845/5 "2021-10-11T17:26:10Z")
Interesting. I can achieve the same effect (it works from the outside) after having run ssh -T [git@bitbucket.org](mailto:git@bitbucket.org) Seems, I would need to add bitbucket as known host somehow before the clone attempt… [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/known\_hosts\_module.html](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/known_hosts_module.html) ---
**Author:** ![Neil\_Young](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Neil\_Young](https://forum.ansible.com/u/Neil_Young)\ **Post date:** [October 11, 2021, 5:35pm UTC](https://forum.ansible.com/t/ssh-agent-forwarding/35845/6 "2021-10-11T17:35:01Z")
Same result with ssh-keyscan [bitbucket.org](http://bitbucket.org) \>\> ~/.ssh/known\_hosts on the remote node. I think in order to make ssh-agent forwarding work with ansible (at least with bitbucket) one has to make sure the node knows about the public key of bitbucket beforehand. ---
**Author:** ![Neil\_Young](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Neil\_Young](https://forum.ansible.com/u/Neil_Young)\ **Post date:** [October 11, 2021, 5:44pm UTC](https://forum.ansible.com/t/ssh-agent-forwarding/35845/7 "2021-10-11T17:44:03Z")
Finally this works for me: ---
**Author:** ![Joe\_Vellella](https://avatars.discourse-cdn.com/v4/letter/j/8e7dd6/32.png) [@Joe\_Vellella](https://forum.ansible.com/u/Joe_Vellella)\ **Post date:** [June 28, 2023, 3:41pm UTC](https://forum.ansible.com/t/ssh-agent-forwarding/35845/8 "2023-06-28T15:41:05Z")
Moving become out of the main play only into the specific ones I needed to solve my issue. Thanks 2 years later!