Save identities added by ssh-add so they persist

Question

I recently setup openssh so I could use it with git.

In the process of setting it up (as per this article) I ran the commands:

$ eval "$(ssh-agent -s)"
$ ssh-add ~/.ssh/<name of key>

Some time later, after I logged out and back in I tried to use git push I got an error. The solution to this error was running those same commands again.

Please tell me how I can

• Keep the ssh-agent running so I don't have to start a new one
• Remember the keys I've added so I don't have to add them everytime

Just to clarify, I use zsh so certain bash features won't work in my .zshrc.

Solution 1

What is ssh-agent for and how does it work?

The ssh-agent keeps your decrypted keys securely in memory and in your session. There is no reasonable and safe way to preserve the decrypted keys among reboots/re-logins.

OK, how can I automate it?

Automate ssh-agent startup

Add

[ -z "$SSH_AUTH_SOCK" ] && eval "$(ssh-agent -s)"

to your ~/.bashrc or other startup script (~/.zshrc).

Automate adding the keys

The keys can be automatically added upon the first usage, when you add

AddKeysToAgent yes

to your ~/.ssh/config.

For more information on ~/.ssh/config see man ssh_config.

Solution 2

Add this to ~/.bashrc

This means ssh-agent will be started automatically when you open another session no your terminal

if [ -z "$SSH_AUTH_SOCK" ] ; then
 eval `ssh-agent -s`
fi

if you need a key to be added to the agent also add this

if [ -z "$SSH_AUTH_SOCK" ] ; then
 eval `ssh-agent -s`
 ssh-add ~/.ssh/<your private ssh key>
fi

Comments

[Jakuje]

You should start with understanding what is ssh-agent for and how does it work before trying to suit it your twisted use case.

[Jakuje]

What error you got?

[timotree]

@Jakuje The error was about a missing pubkey and asked "Have you started ssh-agent?".

[timotree]

So you're saying if I enable AddKeysToAgent, then whenever I type eval "$(ssh-agent -s)" it will add my key?

[Jakuje]

If the agent is running and your ssh supports this option, then yes.

[timotree]

Can you please clarify how I would automate starting the ssh-agent then?

[Jakuje]

Basically, as explained in the other answer. [ -z "$SSH_AUTH_SOCK" ] && eval $(ssh-agent)

[timotree]

Does that work with zsh?

[Jakuje]

Yes, but in that case, it is not ~/.bashrc, but ~/.zshrc or similar file.

[timotree]

Let us continue this discussion in chat.

[timotree]

This was a good answer but doesn't explain what the command does.

[mindplay.dk]

On Ubuntu 19.10, I ended up with two instances of ssh-agent, as it appears to come preinstalled (?) - you can check with ps -e | grep 'ssh' to see if it's running. I only needed to add the the AddKeysToAgent yes setting to .ssh/config to make added keys persist between reboots.

[huangbiubiu]

I suggest redirecting the output to /dev/null, otherwise the ssh-agent will print the pid when login, which might cause failing using rsync. See serverfault.com/a/328404/576442. You can use [ -z "$SSH_AUTH_SOCK" ] && eval "$(ssh-agent -s)" > /dev/null 2>&1

[HalfWebDev]

How can we persist passphrase?