Setting up SSH but running into 'SSH Agent: error connecting with ssh-agent: dial unix: missing address'

[VinvarLaLece]

Dear all,

I am doing something (horribly?!) wrong and I was hoping you could help me. I am trying to achieve having a Proxmox container running as my CA which acts as an ACME for my internal domains and as a SSH certificate handler. The use case will be that I will login to this container and to other containers from my laptop.

I am trying to set up SSH with STEP CA following tutorial and forum-post. The steps below result in an error message ✗ SSH Agent: error connecting with ssh-agent: dial unix: missing address. Could someone help me where I make the mistake?

---

I have set up two containers on Proxmox with the helper script from Proxmox Helper Scripts.
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/debian.sh)"
As long as I am testing, I allow SSH login by the root user.

One container called step-host will be the desired CA and the other (called step-client) will act as my laptop. From what I understand, the Vagrant from the tutorial equals as my laptop.
For testing I do not like to 'clog' my laptop or change configuration while I am not completely sure. Therefore, I make use of the second container.

On the step-host I install Step CA with the following bash script.

function generate_password () {
    set +o pipefail
    < /dev/urandom tr -dc A-Za-z0-9 | head -c16
    echo
    set -o pipefail
}

function ufw_install () {
    # UFW: we do not want the wrong access.
    apt-get update >> /dev/null 2>&1
    apt-get install -y ufw >> /dev/null 2>&1

    # Rules for Step CA
    ufw allow in from 1[redacted]/24 proto tcp to any port 22 >> /dev/null 2>&1
    ufw allow in from 1[redacted]/24 proto tcp to any port 443 >> /dev/null 2>&1

    ufw enable >> /dev/null 2>&1
}

ufw_install

# Install dependencies & Step CA.
apt-get update && apt-get install -y --no-install-recommends curl gpg ca-certificates
curl -fsSL https://packages.smallstep.com/keys/apt/repo-signing-key.gpg -o /etc/apt/trusted.gpg.d/smallstep.asc && \
    echo 'deb [signed-by=/etc/apt/trusted.gpg.d/smallstep.asc] https://packages.smallstep.com/stable/debian debs main' \
    | tee /etc/apt/sources.list.d/smallstep.list
apt-get update && apt-get -y install step-cli step-ca

# Create group & user.
useradd --user-group --system --home /etc/step --shell /bin/false step

# Set up directories & files needed.
mkdir /etc/step
generate_password > /etc/step/password
generate_password > /etc/step/password-provisioner

# Instantiate Step CA
step ca init --acme --ssh --address=:443 --deployment-type=standalone --dns=1[redacted] --dns=certificates.[redacted] --name=example.com --password-file=/etc/step/password --provisioner-password-file=/etc/step/password-provisioner --provisioner=main

# Give Step CA permissions to bind to ports under 1024.
setcap CAP_NET_BIND_SERVICE=+eip $(which step-ca)

# Move Step CA from root user('s folder) to folder which can be ran be the user step.
mv $(step path)/* /etc/step
sed -i 's/root\/.step/etc\/step/g' /etc/step/config/ca.json
chown -R step:step /etc/step
rm -r /root/.step/

# Create a Systemd service to run Step CA (with user step)
cat <<EOF > /etc/systemd/system/step-ca.service
[Unit]
Description=step-ca service
Documentation=https://smallstep.com/docs/step-ca
Documentation=https://smallstep.com/docs/step-ca/certificate-authority-server-production
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=30
StartLimitBurst=3
ConditionFileNotEmpty=/etc/step/config/ca.json
ConditionFileNotEmpty=/etc/step/password
ConditionFileNotEmpty=/etc/step/password-provisioner

[Service]
Type=simple
User=step
Group=step
Environment=STEPPATH=/etc/step
WorkingDirectory=/etc/step
ExecStart=/usr/bin/step-ca config/ca.json --password-file password
ExecReload=/bin/kill --signal HUP $MAINPID
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
StartLimitInterval=30
StartLimitBurst=3

; Process capabilities & privileges
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
SecureBits=keep-caps
NoNewPrivileges=yes

; Sandboxing
ProtectSystem=full
ProtectHome=true
RestrictNamespaces=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
PrivateTmp=true
PrivateDevices=true
ProtectClock=true
ProtectControlGroups=true
ProtectKernelTunables=true
ProtectKernelLogs=true
ProtectKernelModules=true
LockPersonality=true
RestrictSUIDSGID=true
RemoveIPC=true
RestrictRealtime=true
SystemCallFilter=@system-service
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
ReadWriteDirectories=/etc/step/db

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now step-ca
systemctl status step-ca

# Add root_ca to trust store of machine
cp /etc/step/certs/root_ca.crt /usr/local/share/ca-certificates/root_ca.crt
update-ca-certificates

So far, so good. But then I get lost in the tutorial figuring out what I need to do on the step-host and step-client.

Given the host-bootstrap.sh from the tutorial and the next step of the forum-post, I understand I need to make a certificate.
On the step-host I run cat /etc/step/password-provisioner and step ssh certificate certificates.[redacted] /etc/ssh/ssh_host_ecdsa_key.pub --host --sign --provisioner "main" --ca-url https://certificates.[redacted] --root /etc/step/certs/root_ca.crt and I type/copy the provisioner password.
step ssh inspect /etc/ssh/ssh_host_ecdsa_key-cert.pub shows a valid certificate with the values entered in the previous command.

Although my use case is that I can connect from the step-client to the step-host, I follow the tutorial as a learning exercise. As I clearly have no idea yet at this point. :)
To connect from the step-host to the step-client I ran the following command on the step-client cat /etc/ssh/ssh_host_ecdsa_key.pub.

I copy the 'ecdsa-sha2-nistp256 ...' to the step-host by echo "@cert-authority * ...copied_from_step-client..." >> ~/.ssh/known_hosts. Please notice that I do not copy the 'root@step-client' stated at the end.

On the step-host I add the following to the /etc/ssh/sshd_config and restart ssh without any issues.

TrustedUserCAKeys /etc/step/certs/ssh_user_key.pub
# Path to the private key and certificate
HostKey /etc/ssh/ssh_host_ecdsa_key
HostCertificate /etc/ssh/ssh_host_ecdsa_key-cert.pub

On the step-host I run step ssh certificate testuser testuser_ecdsa --ca-url https://certificates.[redacted] --root /etc/step/certs/root_ca.crt which results in the following output

Please enter the password to decrypt the provisioner key: 
✔ CA: https://certificates.[redacted]
Please enter the password to encrypt the private key: 
✔ Private Key: testuser_ecdsa
✔ Public Key: testuser_ecdsa.pub
✔ Certificate: testuser_ecdsa-cert.pub
✗ SSH Agent: error connecting with ssh-agent: dial unix: missing address

Running ssh-add -l results in Could not open a connection to your authentication agent.

Would you have an idea what I am doing wrong?

[VinvarLaLece]

Solved the issue. You should run eval $(ssh-agent) to start the SSH against. Run this before the step certificate ... command.