Read more

Make Capistrano use SSH Key Forwarding

Thomas Eisenbarth
February 13, 2012Software engineer at makandra GmbH

When deploying code with Capistrano (depending on your configuration) at some point Capistrano tries to check out code from your repository. In order to do so, Capistrano connects to your repository server from the application server you're deploying to with SSH. For this connection you can use two SSH keys:

  • the user's ~/.ssh/id_rsa [default]
  • the very same key you used for connecting to the application server - forwarded automatically to the git repository.
Illustration book lover

Growing Rails Applications in Practice

Check out our e-book. Learn to structure large Ruby on Rails codebases with the tools you already know and love.

  • Introduce design conventions for controllers and user-facing models
  • Create a system for growth
  • Build applications to last
Read more Show archive.org snapshot

If you prefer the second way, add this to deploy.rb:

ssh_options[:forward_agent] = true

Warning

Agent forwarding should be enabled with caution. Users with the ability to bypass file permission on the remote host (e.g. the root user) can access the local agent through the forwarded connections. Its not possible to extract your key, but it would be possible to use your agent forwarding to connect to other hosts with your agent/identity.

Never enable SSH Agent forwarding globally in your ssh_config

Posted by Thomas Eisenbarth to makandra dev (2012-02-13 08:59)