Instead of invoking ssh-add to add every key to ssh-agent, is it possible to add those keys automatically as soon as they are asked by ssh? Likewise agents launched by desktop environments do?

EDIT: What is the difference of agents launched by desktop environments (eg. forked from gnome-keyring-daemon) from agents launched by command line that would "add" this behaviour?

In Mate sessions (Linux Mint) as soon as ssh adds its first key to the agent a new process shows up, the one which SSH_AUTH_SOCK seems to point to, however there is a point preceding "ssh" name (".ssh" instead of "ssh"). This process is launched by "gnome-keyring-daemon", check the process PIDs on the screenshot below:

enter image description here

  • @PhilipCouling Isn't it enough referring the keyring gnome-keyring-daemon? – Luciano Mar 19 '19 at 12:54
  • The OP added gnome-keyring-daemon in response to my comment. – Philip Couling Mar 19 '19 at 15:33

Sufficiently recent versions of ssh (7.2, released early 2016, and newer) have an option AddKeysToAgent which does just that:


Specifies whether keys should be automatically added to a running ssh-agent(1). If this option is set to yes and a key is loaded from a file, the key and its passphrase are added to the agent with the default lifetime, as if by ssh-add(1). If this option is set to ask, ssh(1) will require confirmation using the SSH_ASKPASS program before adding a key (see ssh-add(1) for details). If this option is set to confirm, each use of the key must be confirmed, as if the -c option was specified to ssh-add(1). If this option is set to no, no keys are added to the agent. The argument must be yes, confirm, ask, or no (the default).

As to differences in behaviour: the ssh-agent protocol follows a standard, which boils down to the following: the client (ssh, or ssh-add, or anybody else interested) knows who to talk to by looking at the environment variable SSH_AUTH_SOCK. The protocol, slightly simplified, has the following operations:

  1. key management operations: add, remove, list available keys

  2. message operations: sign, encrypt, etc.

Usually, you'd use ssh-add for the first kind. But, as said, new sshs will add as well. When you ask about on-demand loading of keys: an agent might do something fancy when you ask for a list of available keys – the standard implementation requires you to add all the keys beforehand, but a desktop environment implementation might have keys in some wallet storage protected by a master password, and ask for the password when you first try to use any key. (Or maybe you mean keys are shared between different terminal windows? That's just a matter of getting the environment variable SSH_AUTH_SOCK into all your terminals, which is why it's good to start the agent in your session, so all terminals inherit the variable.)

  • That worked like a charm, thanks! But, there's still a question how do those "keyring-daemon" work changing ssh-agent behaviour? – Luciano Mar 15 '19 at 18:18
  • I'm not sure what you mean by that. The daemons replace openssh's ssh-agent by their own, which also understands ssh-add. – Ulrich Schwarz Mar 15 '19 at 18:26
  • I've improved the question "EDIT" session. Hopefully, it really improves the question. – Luciano Mar 19 '19 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.