SSHAgent

ssh-agent is a background process that stores private keys used for SSH public key authentication, allowing users to authenticate to remote systems without re-entering passphrases for every connection. It is part of OpenSSH and runs on most Unix-like systems, with ports or equivalents available on other platforms.

How it works: When started, ssh-agent runs in the background and prints environment variables (such as SSH_AUTH_SOCK and SSH_AGENT_PID) that the user or shell must evaluate to enable clients to communicate with the agent. The agent keeps private keys in memory and signs data on demand. Keys are loaded into the agent with ssh-add, which may prompt for the key’s passphrase. SSH clients (ssh, scp, sftp) query the agent via a per-user UNIX domain socket to perform authentication.

Usage: A typical workflow is to start an agent, add one or more identities with ssh-add, and then use SSH as usual. The agent can be started automatically by a session manager. To inspect loaded keys, use ssh-add -l; to remove keys, use ssh-add -D or ssh-add -d <key>. Keys can be assigned a lifetime with -t and access can be constrained to prompting with -c.

Security considerations: Private keys reside in the agent’s memory, protected by the key’s passphrase but still exposed to theft if the machine is compromised. Use reputable access controls, restrict or disable agent forwarding on untrusted hosts, and prefer passphrase-protected keys. Manage socket permissions carefully and consider locking or terminating the agent when leaving a workstation.

Related concepts: Several desktop environments integrate ssh-agent with keyrings, and there are wrappers and alternatives (such as keychain or gpg-agent) that manage the agent lifecycle and persistence.