Using Pageant SSH Keys in WSL 2

Pageant is PuTTY‘s utility to load and cache your SSH private keys. It’s a convenient way to avoid entering your passphrase over and over again whenever the unlock timeout is reached. It’s very convenient to use everywhere, including VS Code, Git Bash, and so on. The only thing needed is a properly set GIT_SSH environmental variable:

GIT_SSH=C:\Program Files\PuTTY\plink.exe

Now, what if you want to have the same convenience within WSL? It makes no sense to copy over your SSH and face the same problem: constant key unlocks. Well, there’s a way.

wsl2-ssh-pageant does just this. It’s archived, but until someone more informed tells me it’s swarming with security holes, I’ll keep using it, because it just works. Setting it up is really simple.

Download it:

DEST="${HOME}/.local/bin/wsl2-ssh-pageant.exe"
mkdir -p $(dirname "${DEST}")
wget -O "${DEST}" "https://github.com/BlackReloaded/wsl2-ssh-pageant/releases/latest/download/wsl2-ssh-pageant.exe"
chmod +x "${DEST}"

DEST="${HOME}/.local/bin/wsl2-ssh-pageant.exe"
mkdir -p $(dirname "${DEST}")
wget -O "${DEST}" "https://github.com/BlackReloaded/wsl2-ssh-pageant/releases/latest/download/wsl2-ssh-pageant.exe"
chmod +x "${DEST}"

Install the dependencies, too:

sudo apt install socat iproute2

Add to your .bashrc:

export SSH_AUTH_SOCK="$HOME/.ssh/agent.sock"
if ! ss -a | grep -q "$SSH_AUTH_SOCK"; then
  rm -f "$SSH_AUTH_SOCK"
  wsl2_ssh_pageant_bin="$HOME/.local/bin/wsl2-ssh-pageant.exe"
  if test -x "$wsl2_ssh_pageant_bin"; then
    (setsid nohup socat UNIX-LISTEN:"$SSH_AUTH_SOCK,fork" EXEC:"$wsl2_ssh_pageant_bin" >/dev/null 2>&1 &)
  else
    echo >&2 "WARNING: $wsl2_ssh_pageant_bin is not executable."
  fi
  unset wsl2_ssh_pageant_bin
fi

export SSH_AUTH_SOCK="$HOME/.ssh/agent.sock"
if ! ss -a | grep -q "$SSH_AUTH_SOCK"; then
  rm -f "$SSH_AUTH_SOCK"
  wsl2_ssh_pageant_bin="$HOME/.local/bin/wsl2-ssh-pageant.exe"
  if test -x "$wsl2_ssh_pageant_bin"; then
    (setsid nohup socat UNIX-LISTEN:"$SSH_AUTH_SOCK,fork" EXEC:"$wsl2_ssh_pageant_bin" >/dev/null 2>&1 &)
  else
    echo >&2 "WARNING: $wsl2_ssh_pageant_bin is not executable."
  fi
  unset wsl2_ssh_pageant_bin
fi

Restart your Bash session, and you’re good to go!