Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use ssh-add to add my SSH keys to the SSH agent. By default, it adds them indefinitely. There's a command-line option to specify a timeout, but is there a configuration file option which will specify the default timeout?

What I want is to be able to run ssh-add without any command-line parameters and have it default to a given amount of time for a timeout (as if I had called ssh-add -t 1h).

share|improve this question
up vote 4 down vote accepted

AFAIK, there is no configuration in sshd_config or ssh_config to specify the time out for ssh-agent. From openssh source code, file ssh-agent.c:

/* removes expired keys and returns number of seconds until the next expiry */  
static time_t                                                                   
    time_t deadline = 0, now = monotime();                                      
    Identity *id, *nxt;                                                         
    int version;                                                                
    Idtab *tab;                                                                 

    for (version = 1; version < 3; version++) {                                 
        tab = idtab_lookup(version);                                            
        for (id = TAILQ_FIRST(&tab->idlist); id; id = nxt) {                    
            nxt = TAILQ_NEXT(id, next);                                         
            if (id->death == 0)                                                 
            if (now >= id->death) {                                             
                debug("expiring key '%s'", id->comment);                        
                TAILQ_REMOVE(&tab->idlist, id, next);                           
            } else                                                              
                deadline = (deadline == 0) ? id->death :                        
                    MIN(deadline, id->death);                                   
    if (deadline == 0 || deadline <= now)                                       
        return 0;                                                               
        return (deadline - now);                                                

And in process_add_identity function:

process_add_identity(SocketEntry *e, int version)                               
if (lifetime && !death)                                                     
        death = monotime() + lifetime;

lifetime is a global variable and only change value when parsing argument:

/* Default lifetime in seconds (0 == forever) */                                
static long lifetime = 0;

main(int ac, char **av)                                                         
    case 't':                                                               
        if ((lifetime = convtime(optarg)) == -1) {                          
            fprintf(stderr, "Invalid lifetime\n");                          

If you use Ubuntu, you can set default options for ssh-agent in /etc/X11/Xsession.d/90x11-common_ssh-agent:


if has_option use-ssh-agent; then
  if [ -x "$SSHAGENT" ] && [ -z "$SSH_AUTH_SOCK" ] \
     && [ -z "$SSH2_AUTH_SOCK" ]; then
    if [ -f /usr/bin/ssh-add1 ] && cmp -s $SSHAGENT /usr/bin/ssh-agent2; then
      # use ssh-agent2's ssh-agent1 compatibility mode

if [ -n "$STARTSSH" ]; then
share|improve this answer

If you're calling ssh-add on the command line, make a shell alias. Put the following line in your ~/.bashrc (if using bash) or ~/.zshrc (if using zsh) or other applicable shell initialization file:

alias ssh-add='ssh-add -t 1h'

If you want to add a non-expiring key, use \ssh-add /path/to/key or ssh-add -t 0 /path/to/key.

If ssh-add is being called from other program, see if they can be configured to take arguments. Failing that, create a file early on your $PATH (~/bin is a common choice of directory, make sure it's at the beginning of your PATH and create it if it doesn't exist) called ssh-add containing

exec /usr/bin/ssh-add -t 1h "$@"

(Replace /usr/bin/ssh-add by the path to the ssh-add binary as necessary.)

share|improve this answer
A shell alias would probably be the right course of action. – Naftuli Tzvi Kay Apr 2 '14 at 1:24

The default timeout is forever. It is however possible to set the default timeout for a specific agent through the -t option of ssh-agent.

from man ssh-agent:

-t life
        Set a default value for the maximum lifetime of identities added
        to the agent.  The lifetime may be specified in seconds or in a
        time format specified in sshd_config(5).  A lifetime specified
        for an identity with ssh-add(1) overrides this value.  Without
        this option the default maximum lifetime is forever.
share|improve this answer
Is there a way to configure ssh-add so that the default is something other than forever? If I just run ssh-add without any parameters, I'd like it to time out after an hour. – Naftuli Tzvi Kay Apr 1 '14 at 7:06
How to launch the ssh-agent ? – Ouki Apr 1 '14 at 7:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.