ssh-agent: Unlocking keys once

In short: A background program that keeps decrypted SSH keys in memory so you do not have to retype the passphrase for every connection.

In more detail: A private SSH key should be protected with a passphrase. Whoever makes many connections daily would have to type it constantly. The ssh-agent decrypts the key once and then makes it available to programs that need it for sign-ins. The private key never leaves the agent; only signatures are requested.

In Depth

Usage

eval "$(ssh-agent -s)"          # start the agent (if not automatic)
ssh-add ~/.ssh/id_ed25519       # load key, enter passphrase once
ssh-add -l                      # list loaded keys
ssh-add -t 4h ~/.ssh/id_ed25519 # keep the key for 4 hours only
ssh-add -D                      # remove all

Many desktop environments start an agent at login (GNOME Keyring, KDE Wallet, macOS keychain, Windows OpenSSH agent) and load keys automatically.

Agent forwarding

With ssh -A server (or ForwardAgent yes) the agent is passed on to an intermediate machine. From there you can reach a third server with your own keys without storing the key there. Risk: whoever is root on the intermediate machine can use the forwarded agent for their own sign-ins as long as you are connected. Better is ProxyJump (ssh -J), which works without agent forwarding.

Security

A running agent is convenient but a point of attack: malware running as your user can request signatures. Set time limits (-t), confirm use when needed (ssh-add -c) and unload keys when you do not need them. Hardware keys (FIDO2, ed25519-sk) require a touch for every sign-in and are even more secure.

Interplay

Generate a key pair: ssh-keygen -t ed25519. You put the public part (.pub) into the server’s ~/.ssh/authorized_keys (ssh-copy-id). The agent holds the private part. With a file ~/.ssh/config hosts, users and keys can be stored permanently.

See also: SSH on Linux, SSH, SSH tunnel