9.3.4 Unix-domain sockets: integrating with WSL 1

Pageant can listen on the WinSock implementation of ‘Unix-domain sockets’. These interoperate with the Unix-domain sockets found in the original Windows Subsystem for Linux (now known as WSL 1). So if you ask Pageant to listen on one of these, then your WSL 1 processes can talk directly to Pageant.

To configure this, run Pageant with the option --unix, followed with a pathname. Then, in WSL 1, set the environment variable SSH_AUTH_SOCK to point at the WSL translation of that pathname.

For example, you might run

pageant --unix C:\Users\Simon\.ssh\agent.sock

and in WSL 1, set the environment variable

SSH_AUTH_SOCK=/mnt/c/Users/Simon/.ssh/agent.sock

Alternatively, you can add a line to your .ssh/config file inside WSL that says

IdentityAgent /mnt/c/Users/Simon/.ssh/agent.sock

although doing it like that may mean that ssh-add commands won't find the agent, even though ssh itself will.

Security note: Unix-domain sockets are protected against access by other users by the file protections on their containing directory. So if your Windows machine is multiuser, make sure you create the socket inside a directory that other users can't access at all. (In fact, that's a good idea on general principles.)

Compatibility note: WSL 2 processes cannot talk to Pageant by this mechanism, because WSL 2's Unix-domain sockets are managed by a separate Linux kernel, and not by the same kernel that WinSock talks to.