SSH_AUTH_SOCK hack stopped working under tmux 3.6

[Tobias Damisch]

Problem:

Reattaching to a tmux session after a SSH session with -A agent
forwarding broke and reconnected makes the agent not work from inside tmux.

I used to make persistent auth sock forwarding work with this trick
under tmux next-3.4:


MAKE SSH AUTH_SOCK AGENT FORWARDING WORK IN TMUX
-----------------------------------------------------
put:
# first, unset update-environment[SSH_AUTH_SOCK] (idx 3), to prevent
# the client overriding the global value
set-option -g -u update-environment[3]
# And set the global value to our static symlink'd path:
set-environment -g SSH_AUTH_SOCK $HOME/.ssh/ssh_auth_sock

..into .tmux.conf

vim ~/.ssh/rc
-----------------------------------------------------------------------
#!/bin/sh

# On SSH connection, create stable auth socket path for Tmux usage
if test "$SSH_AUTH_SOCK"; then
ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
fi

# do initialization stuff that would be done if rc was not there,
# but is not done automatically if it is there *rolleyes*
# (copied straight from 'man sshd')
if read proto cookie && [ -n "$DISPLAY" ]; then
if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then
# X11UseLocalhost=yes
echo add unix:`echo $DISPLAY |
cut -c11-` $proto $cookie
else
# X11UseLocalhost=no
echo add $DISPLAY $proto $cookie
fi | xauth -q -
fi
-----------------------------------------------------------------------

However, this doesn't seem to work on all machines I pushed tmux 3.6 to.
Any clues to what needs to be changed in order for it to work again?
Or: Any better, more modern solutions to the problem?

Cheers,
Tobias

[Nicholas Marriott]

I don't know why it wouldn't work.

Is the global environment still correct (tmux showenv -g SSH_AUTH_SOCK)? 

What about the session (tmux showenv SSH_AUTH_SOCK)? 

What does echo $SSH_AUTH_SOCK show in a new pane?

tmux logs?

--
You received this message because you are subscribed to the Google Groups "tmux-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tmux-users+...@googlegroups.com.
To view this discussion, visit https://groups.google.com/d/msgid/tmux-users/80822341-c859-499d-8149-2f1cb147874e%40gmx.at.

[Tobias Damisch]

Inside tmux:

> tmux showenv -g SSH_AUTH_SOCK
SSH_AUTH_SOCK=/home/user/.ssh/ssh_auth_sock
> echo $SSH_AUTH_SOCK
/tmp/ssh-E0rzE8HFKj/agent.4108400
> tmux showenv SSH_AUTH_SOCK
SSH_AUTH_SOCK=/tmp/ssh-E0rzE8HFKj/agent.4108400

So, it seems the global environment is somehow overwritten.
No time for tmux logs now, will check later if necessary.

[Nicholas Marriott]

What about "tmux show -g update-environment" and "tmux show update-environment"? Is SSH_AUTH_SOCK correctly removed?

If you do something like this:

tmux set remain-on-exit on

tmux splitw -- env --

What do you see in SSH_AUTH_SOCK? This will show whether tmux is setting it incorrectly or the shell is changing it.

--
You received this message because you are subscribed to the Google Groups "tmux-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tmux-users+...@googlegroups.com.

To view this discussion, visit https://groups.google.com/d/msgid/tmux-users/9d3902e1-855b-431c-b13a-7c5fb4fad99b%40gmx.at.

[Tobias Damisch]

Ah, thanks for "tmux show -g update-environment", I solved it!
using:
set-option -g -u update-environment[4]
instead of:

set-option -g -u update-environment[3]

in .tmux.conf did the trick!


Am 03.02.26 um 12:42 schrieb Nicholas Marriott:

> What about "tmux show -g update-environment" and "tmux show update-
> environment"? Is SSH_AUTH_SOCK correctly removed?
>
> If you do something like this:
>
> tmux set remain-on-exit on
> tmux splitw -- env --
>
> What do you see in SSH_AUTH_SOCK? This will show whether tmux is setting
> it incorrectly or the shell is changing it.
>
>
>
>
> On Tue, 3 Feb 2026 at 11:24, 'Tobias Damisch' via tmux-users <tmux-
> us...@googlegroups.com <mailto:tmux-...@googlegroups.com>> wrote:
>
> Inside tmux:
>
>  > tmux showenv -g SSH_AUTH_SOCK
> SSH_AUTH_SOCK=/home/user/.ssh/ssh_auth_sock
>  > echo $SSH_AUTH_SOCK
> /tmp/ssh-E0rzE8HFKj/agent.4108400
>  > tmux showenv SSH_AUTH_SOCK
> SSH_AUTH_SOCK=/tmp/ssh-E0rzE8HFKj/agent.4108400
>
> So, it seems the global environment is somehow overwritten.
> No time for tmux logs now, will check later if necessary.
>
> --
> You received this message because you are subscribed to the Google
> Groups "tmux-users" group.
> To unsubscribe from this group and stop receiving emails from it,
> send an email to tmux-users+...@googlegroups.com

> <mailto:tmux-users%2Bunsu...@googlegroups.com>.

> To view this discussion, visit https://groups.google.com/d/msgid/

> tmux-users/9d3902e1-855b-431c-b13a-7c5fb4fad99b%40gmx.at <https://
> groups.google.com/d/msgid/tmux-users/9d3902e1-855b-431c-
> b13a-7c5fb4fad99b%40gmx.at>.
>

[Nicholas Marriott]

OK yes, my fault, I added MSYSTEM in alphabetical order and that changed the order.

You could do this which would not depend on the positions:

set -gF update-environment "#{s| SSH_AUTH_SOCK||:update-environment}"

To unsubscribe from this group and stop receiving emails from it, send an email to tmux-users+...@googlegroups.com.
To view this discussion, visit https://groups.google.com/d/msgid/tmux-users/7a6a706a-871d-4184-a75f-aef686214553%40gmx.at.