Running emacs 25.2.2 magit 2.12.1 on Kubuntu 18.04.

I have set-up ssh keys for my bitbucket repository and I run ssh-agent on start.

When I fetch or pull or push, magit asks for the passphrase for ssh key.

How can I avoid keying this passphrase every time there is any remote operation?


3 Answers 3


Running ssh-agent and hoping for the best is not enough. ssh-agent hands out the decrypted private key to everyone asking on a specific socket. The problem is that the socket is not always the same and therefore only those processes that know the currently used socket can benefit.

When ssh-agent is started it outputs the socket and its pid.

$ ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-XX4LkMJS/agent.26916; export SSH_AUTH_SOCK;
echo Agent pid 26917;

The intended use is

$ eval $(ssh-agent)

By evaluating the output some environment variables are set and exported so that all subprocesses can see them too.

The reason that a git process started by Magit inside Emacs doesn't know the socket is that the emacs instance is not a subprocess of any process whose environment contains values for the necessary variables.

You can confirm this by running eval $(ssh-agent); ssh-add ~/.ssh/id_rsa in a terminal, and then in the same terminal emacs &. From that emacs instance you will be able to push without being asked for the passphrase again.

Now you have to arrange for these variables to be always set in emacs's environment, regardless of how it was started.

The way I do this is that I start the agent and add the keys using the keychain utility when starting an interactive shell. That causes the variables to be set in all shells, and if I did then type emacs & in a shell, then emacs would have access too. But that's not how I usually start Emacs, so I also use keychain-environment.el, which looks for a file created by keychain and then sets the environment variables it finds in there.

I recommend you read OpenSSH Key Management, Part 2 (the other parts too). It was written by the author of keychain. Also read the description of keychain-environment.el (In particular note that you still have enter the passphrase from outside Emacs once.)

  • Thanks. That was quite exhaustive. At least for a newbie like me! My point was, there are a lot of secrets on my kde wallet; my wifi passwords, for instance. Can the same wallet not store the passphrase and provide it to magit, etc.? With the wallet, I do not have to enter the wifi password, ever!
    – deshmukh
    May 5, 2018 at 12:37
  • It probably can but you will have to figure that out yourself. What makes this so complicated is twofold: (1) Different tasks are delegated to different components, which then have to be configured to cooperated. (2) Over time different components begin assuming that they are the central component and try to take control. The latter is done to make things easier for users and often at their request, but it massively increases complexity and the various control centers start fighting each other.
    – tarsius
    May 5, 2018 at 12:52
  • E.g. If you install keychain (a "control center") to get things working quickly and then later try to use KDE wallet, then your leftover keychain configuration may then conflict with that second approach. And reading documentation about how to do it with KDE wallet won't help because it now is an issue "specific to your machine".
    – tarsius
    May 5, 2018 at 12:56
  • So what I tried with my answer is to shed some light on the central functionality. Understanding that will help you understand and untangle the layers of complexity that have been added on top for the sake of ease of use.
    – tarsius
    May 5, 2018 at 12:58
  • The approach I am using (keychain) is a very thin layer because making it possible to use a single ssh-agent is its only purpose. Using the wallet of desktop environment is much more complex because that wallet tries to keep secrets for many other things. Having such a universal interface is nice in theory, but there are at least two issues (a) it actually isn't universal (b) in this case it is tightly coupled with the specific desktop environment.
    – tarsius
    May 5, 2018 at 13:02

Short answer: launch emacs directly from your shell ; chances are that both the latter and the former, in their current version, know how to handle ssh keyrings.

On Ubuntu 20.04.2 LTS / the latest ZSH and the latest Emacs, it works, Magit doesn't ask for the passphrase ; but if I use some menu system to launch Emacs, it then does.

When you defer the launching to the DE/WM, most probably via the /usr/share/applications/emacs.desktop file, I guess things get "lost in translation".


I'm using Win10 and the only thing I need to do is to open Git bash and then run

ssh-add <path/to/private/key>

provided the return values of M-x getenv SSH_AUTH_SOCK in Emacs and echo $SSH_AUTH_SOCK in Git Bash are the same. If not then you need to change that of Emacs to match what's shown in Git Bash. Then Emacs never asks for passphrase again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.