`ssh-add` gets stuck on nixos

devnchill · August 6, 2026, 8:11am

hello everyone . I am facing issue related to git on my nixos . I have password protected ssh key in ~/.ssh/github .
Everytime i power on my machine and try to do git operation like git pull or git push , it hangs forever . In btop, I see ssh-add process taking 98% of cpu core usage .

if i try to run git push again , i see another ssh-add process in btop , overall this immediately grows to 3-4 ssh-add process in btop .

The only fix everytime i have do is

pkill ssh-add
ssh-add ~/.ssh/github
then it prompts me for password and i enter it and from here on everything works smoothly .

I don’t have anything explicitly set regarding git ssh setup , this is the only place i configure git

Some extra info that I think might be related to this issue is

I use niri which pulls gnome-gcr which seems to be my default ssh-agent ?

λ echo $SSH_AUTH_SOCK
/run/user/1000/gcr/ssh

ssh-add -l does seems to list my keys meaning keys are already loaded upon power on .

λ ssh -vT git@github.com
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa>
debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: agent returned 2 keys
debug1: Will attempt key: /home/viena/.ssh/github ED25519 SHA256:PR1tkHY9KawTyf37vQ1ZAH/wNxuAzHjfgxkiBZhtmZY explicit agent
debug1: Offering public key: /home/viena/.ssh/github ED25519 SHA256:PR1tkHY9KawTyf37vQ1ZAH/wNxuAzHjfgxkiBZhtmZY explicit agent
debug1: Server accepts key: /home/viena/.ssh/github ED25519 SHA256:PR1tkHY9KawTyf37vQ1ZAH/wNxuAzHjfgxkiBZhtmZY explicit agent

after this it just hangs

It would be really helpful if someone could help me fix it …

yueyinqiu · August 10, 2026, 10:22am

I think this might be related to your SSH key being password-protected. I’m also using niri with ssh-agent, and I haven’t run into this issue. If you try removing the passphrase from your SSH key, does the problem still occur?

NobbZ · August 10, 2026, 10:49am

Using an agent for a password less key is just a hint for a broken SSH configuration.

There is really no need to ever add unencrypted keys into an agent, unless you use jump/bastion hosts with agent forwarding.

yueyinqiu · August 10, 2026, 11:26am

@NobbZ Thank you for reminding of this. In my case, I do need to use agent forwarding. And I think this might be related to the current problem; perhaps the user was supposed to be asked to enter a key, but the pop-up window failed to appear.

yueyinqiu · August 10, 2026, 1:04pm

I managed to run your NixOS inside a virtual machine. I also got stuck for a brief period after debug1: Server accepts key, but then this window popped up:

After entering the password, I was able to access GitHub normally.

This is how I ran your system:

nixos-rebuild build-vm --flake .#kalki
QEMU_OPTS="-device virtio-vga-gl -display gtk,gl=on" ./result/bin/run-kalki-vm

After booting into the system, I simply opened Kitty and used ssh-keygen to generate a key pair. It seemed to be added to the agent automatically, so I just uploaded it to GitHub and ran ssh -vT git@github.com. So… I haven’t encountered any issues so far. Are there any more information to share?

devnchill · August 12, 2026, 3:35am

I don’t think so . I shared everything I could . when you generated keyphrase , did you set password for it? I think i’ll try again with a new set of ssh keys (both with and without password) and see if it works this time .

Oh one thing that i forgot to mention is that , I had this config from start , like no additional git config and it was working just fine . however one day it stopped working and that’s when i started trying out different fixes . like disabling gnome-gcr and trying to use sshAgent …

EDIT → Just saw that it popped up for password meaning you did set password too . The gui password prompt just never pops for me T_T

devnchill · August 12, 2026, 4:06am

Okay I created new ssh key and i hit the same issue . it gets stuck at debug 1: Server accepts key but no gui pops up asking for password.

yueyinqiu · August 12, 2026, 4:08am

Yeah, I do suspect it’s an issue with the popup rather than the SSH configuration itself.

As you mentioned that it was working at the start, do you that mean the prompt used to pop up in the beginning and then stopped working later, or has it never popped up from the very beginning?

If it’s the former, I suspect some other applications might be affecting it (and these behaviors aren’t managed by Nix, since my VM didn’t run into this issue). I’m not sure if there’s a better way, but maybe you could try removing all unrelated packages and keeping only SSH, Niri, and Kitty to see if it works (which is easier to do on NixOS than other distros).

If it’s the latter, maybe it means there’s some hardware configuration or driver issue? I’m not sure about this.

devnchill · August 12, 2026, 4:23am

Oh the gui just never popped up however in start it would work without asking for my password . i think it had something to do with auto unlocking during login ? maybe i was not using sddm back then and rather loggin from tty or smth ? I’m not sure .

I’ll try building it in vm and see if it works there

devnchill · August 12, 2026, 4:59am

Hmm i ran it in vm too and this popped up.

but it was still stuck at server accepts key . after waiting for couple of mins i cancelled it and reran ssh -T git@github.com and this time neither the gui pops up asking for password nor is auth successful like it still hangs . and i can see 2 ssh-add in btop .

I stopped vm and re ran it , didn’t know my ssh key would persist , i reran ssh -T git@github.com and it still seems to hang . even the gui does not pops up .

TLDR : password prompt only pops up when running ssh -vT git@github.com for first time . Even after entering password , it seems to hang ? *unless I entered wrong password and the gui then never popped up again ?. And after that no matter how many times i try, gui doesn’t pops up .

EDIT: I entered incorrect password , this time it works in vm . so there is certainly somethign wrong with my hosts as it works flawlessly in vm

yueyinqiu · August 12, 2026, 5:17am

Hmm… We seem to be getting different results here.

After entering the password, I was able to connect to GitHub immediately (with almost no delay in between).

And I don’t need to re-enter the password during the same session, but it will ask for the password again if I reboot the VM.

If it failed in the VM for you as well, I’m suddenly starting to wonder if some file in your nix store might be corrupted. (The VM tries to reuse the host’s /nix/store as possible, and I actually noticed a corrupted store at one of my machines yesterday.)

Of course, this is just my guess, and I’m not sure how to verify it. Will this be helpful?

Feel free if you want to check more information.

devnchill · August 12, 2026, 5:34am

I think i figured out the issue

when i created new ssh key , gui popped up , I entered incorrect password somehow , I ticked on automatically unlock in future session .
Now somehow this is cached , so everytime i try to use git which requires auth , it uses wrong password implicitly and hangs .

What I did now is , I removed the stale keyring , tried ssh -vT git@github.com and gui pops up now and on entering correct password , everything seems to work fine .

Thank you so much @yueyinqiu for the help.