6

while i do ls to the /tmp i found these files what is the meaing of the ssh folder i found

/tmp$ ls 
config-err-pBxjic
e5a28b00f2378661cc615788a1fef225-{87A94AB0-E370-4cde-98D3-ACC110C5967D}
gnome-software-TQ809Y
ssh-Rony2Zd8gQ6O
systemd-private-a789ca0968fb4855b28539acfbf9babe-colord.service-UCNgBR
systemd-private-a789ca0968fb4855b28539acfbf9babe-fwupd.service-4Xkw4W
systemd-private-a789ca0968fb4855b28539acfbf9babe-rtkit-daemon.service-KmLgj9
systemd-private-a789ca0968fb4855b28539acfbf9babe-systemd-resolved.service-F55I3N
systemd-private-a789ca0968fb4855b28539acfbf9babe-systemd-timesyncd.service-W5W5Kx
unity_support_test.0

/tmp$ cd ssh-Rony2Zd8gQ6O/
/tmp/ssh-Rony2Zd8gQ6O$ ls 
agent.1616
/tmp/ssh-Rony2Zd8gQ6O$ cat agent.1616 
cat: agent.1616: No such device or address

so what is the meaning of the existence of this folder and it's content

4
  • Did you use ssh lately? I have a similar folder here containing a symbolic link agent.1909=
    – Videonauth
    Nov 24, 2017 at 20:06
  • no i didn't use SSH at all from this machine
    – Fat Mind
    Nov 24, 2017 at 20:08
  • 2
    O.k. check the output of systemctl --state running | grep ssh
    – Videonauth
    Nov 24, 2017 at 20:10
  • 1
    I'd run ls -aFl. That will show whether or not agent.116 is a special file.
    – RonJohn
    Nov 24, 2017 at 22:18

2 Answers 2

13

The folder contains sockets used by programs to communicate with ssh-agent:

From the man page:

$TMPDIR/ssh-XXXXXXXXXX/agent.< ppid >
    UNIX-domain sockets used to contain the connection to the
    authentication agent.  These sockets should only be readable by
    the owner.  The sockets should get automatically removed when the
    agent exits.
1
  • so you mean it's normal ?
    – Fat Mind
    Nov 25, 2017 at 18:51
1

Florian's answer is correct. However, if you find a lot of them building up, you can put this file in your $HOME/.bash_logout file:

[ -n "$SSH_AGENT_PID" ] &&
    ps -p "${SSH_AGENT_PID}" >/dev/null 2>&1 | grep ssh-agent &&
    kill "${SSH_AGENT_PID}"

I'm not sure if they remain due to a bug, or if that's how ssh-agent is designed. But on some of our systems we see old ssh-agent processes left running and those files left under /tmp. Killing the agent process should remove the /tmp/ssh-whatever directory and files, but if it doesn't on your system, you could add a line to check and remove it based on $SSH_AUTH_SOCK.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.