is it possible to trigger `ssh-add <key>` only when I ssh into a box? (from Cygwin)

Question

I've got my .bash_profile set up to eval $(ssh-agent) so I can quickly connect to servers. If I add ssh-add ~/.ssh/id_rsa_my_key to my .bash_profile as well, I'll have to type the ssh key passphrase in every terminal window, even if I didn't intend to use that terminal window for logging into a server.

I could create an alias to make it trivially easy to type the ssh-add ~/.ssh/id_rsa_my_key line (so I don't have to stop my train of thought about what I'm trying to accomplish and think instead about how I named my key) but I still have to remember to do that before I ssh into a box.

I'm used to working in OS X, where all this is handled almost transparently by the Keychain, and I just ssh away without having to think about access. I'd rather not have to change my mental habits, even though I'm now primarily working from a Windows box. In Windows the ssh-agent dies as soon as I

I'd also rather not do this with aliases or functions for ssh, if it can be avoided. I think that creating aliases and functions that replace normal commands and programs is a somewhat fragile and risky solution: if another problem comes up in the future for which the only solution is to replace ssh then my alias or (more likely) function becomes yet more complex and brittle. Increasingly so the third time, etc. etc. Nonetheless, this may be the only solution. Furthermore, to be useful, the function would have to somehow first check whether the key had already been added, otherwise I'd be adding it every time I logged in, which would accomplish nothing.

Does ssh have some setting to do this automatically? Is there some better solution than adding ssh-add ~/.ssh/id_rsa_my_key to my .bash_profile?

Answer 1

Don't add anything to any of your shell startup scripts, this is unnecessary hackery.

Instead, add

AddKeysToAgent yes

to your .ssh/config

Like this, ssh-add is run automatically the first time you ssh into another box. You only have to re-enter your key when it expires from ssh-agent or after you reboot.

Answer 2

Instead of having ssh-agent generate a random socket name, use the -a option to make it always use the same name. Export this name in the SSH_AUTH_SOCK environment variable. When you log in, run

rm -f "$SSH_AUTH_SOCK"
ssh-agent -a "$SSH_AUTH_SOCK"

This way all your terminals will connect to the same agent. Then, either start one terminal when you log in that runs ssh-add and prompts you for your passphrase, or set SSH_ASKPASS to win-ssh-askpass so that ssh itself will prompt you for a passphrase.

Answer 3

Sure, create a wrapper function and put it in your .bashrc.

Something like this:

ssh () {
  ssh-add -l | grep 'The agent has no identities.' 2>&1 > /dev/null && ssh-add
  /usr/bin/ssh "$@"
}

Although since you're using Cygwin, you'll need the proper path to wherever ssh really is.