pam_ssh_agent_auth: sudo asks for password with ssh user@host, but ssh user@host 'bash' not

Question

I use gpg-agent to manage ssh-agent.

On my PC: ssh-add -L prints my public keys which is used on the server. ForwardAgent is open. pam.d/sudo and sudoers are configured.

After ssh user@host, echo $SSH_AUTH_SOCK print the gpg-agent one. If running sudo -i or other command with sudo, it asks password.

If using ssh user@host 'bash' or other shell, then sudo can run without asking password. By the way, this method will not print any prompt of shell, such as $ .

Set pam.d/sudo with auth ... debug, and get the log:

Nov 10 16:46:23 nixos sudo[30150]: pam_ssh_agent_auth: Beginning pam_ssh_agent_auth for user vonfry Nov 10 16:46:23 nixos sudo[30150]: pam_ssh_agent_auth: Attempting authentication: `vonfry' as `vonfry' using ~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u Nov 10 16:46:23 nixos sudo[30150]: pam_ssh_agent_auth: Contacted ssh-agent of user vonfry (1000) Nov 10 16:46:23 nixos gpg-agent[4022]: scdaemon[4022]: pcsc_establish_context failed: no service (0x8010001d) Nov 10 16:46:23 nixos sudo[30150]: pam_ssh_agent_auth: Failed Authentication: `vonfry' as `vonfry' using ~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u 

On the server, gpg-agent is listed in htop owned by my ssh login user and gpg-connect-agent can work. TTY and GPG_TTY are the same.

htop showed gpg-agent has a subprocess scdaemon --multi-server

I tried to search around gpg-agent[4022]: scdaemon[4022]: pcsc_establish_context failed: no service (0x8010001d), but got nothing useful.

EDIT1: If I kill the ssh login user's gpg-agent daemon, the sudo can work without password.

Answer 1

I find the reason. My interactive shell script re-export the SSH_AUTH_SOCK variable which override the original one from sshd.