Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to determine the passphrases of private keys added to ssh-agent?

I'm thinking along the lines of someone with root privileges trying to find out my passphrase after I have added the key (so I don't mean something like keylogging while typing the password).

share|improve this question
up vote 10 down vote accepted

No, it does not store the passphrase.

What it does do is store the unlocked/decrypted key in memory so that it can use it to sign requests on an add-needed basis without prompting the user to unlock it each time. As long as you have the agent running your session is vulnerable to somebody with the needed permissions (your user or root) accessing the socket that talks to the agent and using whatever keys are loaded in your agent to sign their own requests and thus log into anything that your private key gets you into.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.