Ssh-agent never prompts to enter passphrase

Support and Help
, , ,
1

Ubuntu Version:
Ubuntu 25.10 x86_64

Desktop Environment (if applicable):
GNOME 49.0

Problem Description:

Ever since upgrading to Ubuntu 25 when i try to use a anything that requires me to unlock one of my ssh keys the program hangs and i am never prompted to enter my passphrase

Previously on Ubuntu 24 a window would open asking for my passphrase, or i would be prompted in the terminal

ricardo@ricardo $ git fetch
^C
ricardo@ricardo [1]$

If i clear the SSH_AUTH_SOCK environment variable it prompts for my passphrase without any problems

ricardo@ricardo $ SSH_AUTH_SOCK= git pull
Enter passphrase for key '/home/ricardo/.ssh/id_rsa':
Already up to date.
ricardo@ricardo $

Manually running ssh-add correctly prompts for the passphrase and unlocks the key for current session

ricardo@ricardo $ ssh-add ~/.ssh/id_rsa
Enter passphrase for key '/home/ricardo/.ssh/id_rsa':
ricardo@ricardo $ git pull
Already up to date.
ricardo@ricardo $

When the problem occurs the ssh-add process never terminates

ricardo@ricardo ~$ pgrep -a ssh-add
26699 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
33728 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
217742 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
244018 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
253252 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
515794 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
515914 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa

Relevant System Information:

ricardo@ricardo $ echo $SSH_AUTH_SOCK
/run/user/1001/gcr/ssh

gcr ssh agent status:

ricardo@ricardo ~$ systemctl status --user gcr-ssh-agent.service
● gcr-ssh-agent.service - GCR ssh-agent wrapper
     Loaded: loaded (/usr/lib/systemd/user/gcr-ssh-agent.service; enabled; preset: enabled)
     Active: active (running) since Wed 2025-11-19 09:01:29 -03; 6h ago
 Invocation: 9e01d307a0bd4fdfb01cc161ad6e0e1d
TriggeredBy: ● gcr-ssh-agent.socket
   Main PID: 25133 (gcr-ssh-agent)
      Tasks: 26 (limit: 17950)
     Memory: 8.9M (peak: 11.9M, swap: 4.8M, swap peak: 5.1M)
        CPU: 19h 31min 6.655s
     CGroup: /user.slice/user-1001.slice/user@1001.service/app.slice/gcr-ssh-agent.service
             ├─ 25133 /usr/libexec/gcr-ssh-agent --base-dir /run/user/1001/gcr
             ├─ 26695 /usr/bin/ssh-agent -D -a /run/user/1001/gcr/.ssh
             ├─ 26699 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
             ├─ 33728 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
             ├─217742 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
             ├─244018 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
             ├─253252 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
             ├─515794 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa
             └─515914 /usr/bin/ssh-add /home/ricardo/.ssh/id_rsa

nov 19 09:01:29 ricardo systemd[4212]: Started gcr-ssh-agent.service - GCR ssh-agent wrapper.
ricardo@ricardo ~$ systemctl status --user gcr-ssh-agent.socket
● gcr-ssh-agent.socket - GCR ssh-agent wrapper
     Loaded: loaded (/usr/lib/systemd/user/gcr-ssh-agent.socket; enabled; preset: enabled)
     Active: active (running) since Wed 2025-11-19 09:01:29 -03; 6h ago
 Invocation: 22436e63edb243e5b8a0f5473b541911
   Triggers: ● gcr-ssh-agent.service
     Listen: /run/user/1001/gcr/ssh (Stream)
    Process: 25117 ExecStartPost=/usr/bin/systemctl --user set-environment SSH_AUTH_SOCK=/run/user/1001/gcr/ssh (code=exited, status=0/SUCCESS)
      Tasks: 0 (limit: 17950)
     Memory: 0B (peak: 1.7M)
        CPU: 12ms
     CGroup: /user.slice/user-1001.slice/user@1001.service/app.slice/gcr-ssh-agent.socket

nov 19 09:01:29 ricardo systemd[4212]: Starting gcr-ssh-agent.socket - GCR ssh-agent wrapper...
nov 19 09:01:29 ricardo systemd[4212]: Listening on gcr-ssh-agent.socket - GCR ssh-agent wrapper.
ricardo@ricardo ~$

ricardo@ricardo ~$ sudo apt list  gcr gcr4
gcr4/questing,now 4.4.0.1-7 amd64 [installed,automatic]
gcr4/questing 4.4.0.1-7 i386
gcr/questing,now 3.41.2-4 amd64 [installed,automatic]
gcr/questing 3.41.2-4 i386
2

The SSH_AUTH_SOCK moved for 25.10. WHat is it? Does it exist? It may gave to be /run/user/``id -u``/gcr/ssh.

3 
ricardo@ricardo $ echo $SSH_AUTH_SOCK
/run/user/1001/gcr/ssh

ricardo@ricardo ~$ id -u
1001
4

I have this in my ~/.bashrc

if [ -f ~/.ssh/id_ecdsa ] && [ ! -z "which keychain" ]; then
eval $(keychain --eval --agents ssh id_ecdsa)

where
~/.ssh/id_ecdsa
is my private key file

5

Can you try ssh -T -v to your git remote (e.g. ssh -T -v git@github.com)?

I get lots of protocol info, then You've successfully authenticated, but GitHub does not provide shell access..

ref: https://docs.github.com/en/authentication/connecting-to-github-with-ssh/testing-your-ssh-connection

6 
ricardo@ricardo ~/ $ ssh -T -v git@github.com
debug1: OpenSSH_10.0p2 Ubuntu-5ubuntu5, OpenSSL 3.5.3 16 Sep 2025
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to github.com [4.228.31.150] port 22.
debug1: Connection established.
debug1: identity file /home/ricardo/.ssh/id_rsa type 0
debug1: identity file /home/ricardo/.ssh/id_rsa-cert type -1
debug1: identity file /home/ricardo/.ssh/id_ecdsa type -1
debug1: identity file /home/ricardo/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/ricardo/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/ricardo/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/ricardo/.ssh/id_ed25519 type 3
debug1: identity file /home/ricardo/.ssh/id_ed25519-cert type -1
debug1: identity file /home/ricardo/.ssh/id_ed25519_sk type -1
debug1: identity file /home/ricardo/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/ricardo/.ssh/id_xmss type -1
debug1: identity file /home/ricardo/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_10.0p2 Ubuntu-5ubuntu5
debug1: Remote protocol version 2.0, remote software version 5554dfa
debug1: compat_banner: no match: 5554dfa
debug1: Authenticating to github.com:22 as 'git'
debug1: load_hostkeys: fopen /home/ricardo/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: sntrup761x25519-sha512
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU
debug1: load_hostkeys: fopen /home/ricardo/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host 'github.com' is known and matches the ED25519 host key.
debug1: Found key in /home/ricardo/.ssh/known_hosts:2
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2
-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-
v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ssh-ed25519@openssh.
com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256
,ssh-rsa>
debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: agent returned 3 keys
debug1: Will attempt key: /home/ricardo/.ssh/id_rsa RSA SHA256:LfZXiJbOgLBefPd5MW5bB+8eOL3mgVnY93N22Es5Qnw agent
debug1: Will attempt key: /home/ricardo/.ssh/id_ed25519 ED25519 SHA256:POSqw6U6TTXyzpXzNZsM31+1UGgTtrYbmlkUILZjf0U agent
debug1: Will attempt key: ricardo@ricardo ED25519 SHA256:SvA/FKyOcFheiSQDhNm3KRkxeP2O4OGU02fyFbyy65U agent
debug1: Will attempt key: /home/ricardo/.ssh/id_ecdsa 
debug1: Will attempt key: /home/ricardo/.ssh/id_ecdsa_sk 
debug1: Will attempt key: /home/ricardo/.ssh/id_ed25519_sk 
debug1: Will attempt key: /home/ricardo/.ssh/id_xmss 
debug1: Offering public key: /home/ricardo/.ssh/id_rsa RSA SHA256:LfZXiJbOgLBefPd5MW5bB+8eOL3mgVnY93N22Es5Qnw agent
debug1: Authentications that can continue: publickey
debug1: Offering public key: /home/ricardo/.ssh/id_ed25519 ED25519 SHA256:POSqw6U6TTXyzpXzNZsM31+1UGgTtrYbmlkUILZjf0U agent
debug1: Server accepts key: /home/ricardo/.ssh/id_ed25519 ED25519 SHA256:POSqw6U6TTXyzpXzNZsM31+1UGgTtrYbmlkUILZjf0U agent
^C 
ricardo@ricardo ~/ [1]$
7

Looks like the last line you got was Server accepts key:. I get the same (ed25519). The next line I get is Authenticated to github.com ([140.82.116.4]:22) using "publickey".. Can you check permissions of your files. Your ed_25519 file in~/.ssh should be 600 and the .pub file should be 644. ssh is picky about the file permissions. Also ~/.ssh itself should be 700.