I want to have passwordless ssh to persist even after after I restart or logoff and then login. Somehow I have to run ssh-agent and use command ssh-add at login. In a tutorial I read that I should add the following lines to .bashrc:

if [ -f $ssh_agent ]
  source $ssh_agent > /dev/null

At the same time, the tutorial mentioned that

While ssh-agent is running all your processes (including your cron jobs) shouldn't need a password. However if ssh-agent dies or is killed things might go wrong since the old settings are left over.

I want a safe method which allows me to use ssh without password even after I restart/relogin. Any suggestions?

  • Is there any way to do it in my script say like I use ssh-agent bash ssh-add inside my script? This way it can add the keys and make the connection passwordless whenever I run the script. – Abhishek Anand May 3 '11 at 6:35

The easy way: Install pam_ssh. It will automatically start a ssh-agent and load your keys when you log in.

The hard way: Put this into your login script (~/.bash_profile or ~/.profile):

check-ssh-agent() {
    # `ssh-add` returns 2 if the agent is running but empty; ignore.
    ssh-add -l &>/dev/null || (( $? == 2 ))

if ! check-ssh-agent; then
    if [ -f "$envfile" ]; then
        . "$envfile" >/dev/null
    if ! check-ssh-agent; then
        ssh-agent >"$envfile"
        . "$envfile" >/dev/null
        if [ -t 0 ]; then
            # This `if` can be removed if all your keys are passphrase-less.
    unset envfile

The "leftover settings" are just the $SSH_AUTH_SOCK environment variable, which you can fix easily. (Besides, all that could go wrong is an error message from ssh.)

  • Can't install any additional s/w on the machine. So using pam_ssh is out of question. Can you explain the concept of left-over settings? – Abhishek Anand May 2 '11 at 4:44

Just use a fixed Agent Socket. For example:

export SSH_AUTH_SOCK=/tmp/user.agent
ssh-agent -a /tmp/user.agent
ssh -f -N -R 22:localhost:2222 server

This starts ssh-agent using the socket /tmp/user.agent and then runs ssh-add to load a private key into it. I then start ssh to server with a remote port forward. Attempt to connect to port 2222 on server will be forwarded back to the client and connect to port 22 on the client. -N says don't start a shell and -f says fork and run in background. I use this kind of command to make my desktop accessible from a server without opening up a port on my router. Later when you log in again, the agent will still be running. Just reset the agent socket with export SSH_AUTH_SOCK=/tmp/user.agent and you can run ssh again. ssh-add is only needed after ssh-agent is first started.


With Keychain you can do it as long as you use a key pair without password. It is a simple shell script wrapping ssh-agent, so there is no need to install any additional software.

It automatically detects if you have ssh-agents running and uses them. You can configure it to automatically load a set of keys and to forget them on certain occasions.

Is ideal to deal with cronjobs that require SSH access to a different machine. You only need to source the correct file in ~/.keychain file and it the cronjob will be able to use any key you have setup.

Note: This will work even if you logout but it won't if you restart the system or kill the agent. There is now way to keep a key open if the agent is dead unless you store the password in a file. Obviously this would defeat the whole purpose of password protected keys.


You can use ssh-copy-id to copy your public key to the remote machine. If you didn't add a password when doing ssh-keygen, then it won't prompt for a password whenever you ssh into that remote machine.

So the steps will be something like:

local$ ssh-keygen -t dsa
local$ ssh-copy-id remote
local$ ssh remote

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.