Add a key to the agent
Add a key to the agent with ssh-add and set a lifetime with -t, so the decrypted key is dropped after an hour without any further command.
You want to type a key's passphrase once and have the agent forget the key later, rather than keep it loaded all day.
ssh-keygen -q -t ed25519 -f ./demo_key -N '' -C [email protected]
eval "$(ssh-agent -s)" >/dev/null
ssh-add -t 3600 ./demo_key
ssh-add -l | awk '{print $1, $3, $4}'
ssh-add -D
ssh-add -l
kill "$SSH_AGENT_PID"Identity added: ./demo_key ([email protected])
Lifetime set to 3600 seconds
256 [email protected] (ED25519)
All identities removed.
The agent has no identities.ssh-add hands the decrypted key to the running agent, -t sets a lifetime in seconds after which the agent removes it, and -l lists the loaded keys. -D removes all of them. The options are in the ssh-add manual. The agent talks to clients over the socket named in SSH_AUTH_SOCK, so only processes that can read that socket use the key.
The eval of the agent output is needed once per shell, and a script that starts an agent must kill it, as the last line does. A long-lived agent forwarded with ssh -A lets root on the remote host use your keys while you are connected, so prefer ProxyJump where it fits.