SSH, The Secure Shell: The Definitive Guide, 2nd Edition

SSH Agents

An SSH agent is a program that caches private keys and responds to authentication-related queries from SSH clients. [2.5] They are terrific labor-saving devices, handling all key-related operations and eliminating the need to retype your passphrase.

The programs related to agents are ssh-agent and ssh-add. ssh-agent runs an agent, and ssh-add inserts and removes keys from the agent’s key cache. A typical use might look like this:

    # Start the agent
    $ ssh-agent $SHELL
    # Load your default identity
    $ ssh-add
    Need passphrase for /home/barrett/.ssh/identity ([e-mail]).
    Enter passphrase: ********

By typing your passphrase a single time, you decrypt the private key which is then stored in memory by the agent. From now on, until you terminate the agent or log out, SSH clients automatically contact the agent for all key-related operations. You needn’t type your passphrase again.

We now briefly discuss how agents work. After that we get practical and illustrate different ways to start an agent, various configuration options, and several techniques for automatically loading your keys into the agent. Finally, we cover agent security and agent forwarding.

6.3.1 Agents Do Not Expose Keys

Agents perform two tasks:

• Store your private keys in memory

• Answer questions (from SSH clients) about those keys

Agents don’t, however, send your private keys anywhere. This is important to understand. Once loaded, private keys remain within an agent, unseen by SSH clients. To access a key, a client ...