What is the SSH agent, and how does ssh-add work?
The SSH agent unlocks your key once and signs for you so the key never leaves memory. ssh-add, where it lives on each OS, and why the socket needs guarding. Originally published at termal.in . If you've protected your SSH key with a passphrase — and you should have — you've met the annoyance the agent exists to solve: type that passphrase for every single connection, or leave the key unprotected.…
The SSH agent is a small background process that securely holds your decrypted private keys in memory, eliminating the need to repeatedly enter your passphrase for each connection. To use the SSH agent, you first start it using the command `eval $(ssh-agent -s)`, which sets two shell variables: SSH_AUTH_SOCK (the path to the agent's socket) and SSH_AGENT_PID (the agent's process ID).
Once the agent is running, you can load your private key into memory with the command `ssh-add ~/.ssh/id_ed25519`, which prompts you for your passphrase once. After adding a key to the agent, future connections that require that key will be authenticated automatically, without further prompts. To manage your keys, you can list the loaded keys with `ssh-add -l`, remove a specific key using `ssh-add -d ~/.ssh/id_ed25519`, or remove all keys with `ssh-add -D`.
You can also set a timeout for each key using `ssh-add -t 3600 ~/.ssh/id_ed25519`, which will automatically remove the key from the agent after one hour. When the agent is started, it does not share the private keys with anyone or transmit them over the network; it only signs challenges sent by servers, keeping the actual keys encrypted in memory.
However, it's essential to be cautious about agent forwarding, as it exposes the live signing oracle to any process that can reach the agent's socket, potentially allowing unauthorized signers if the host is compromised.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
