Instead of invoking ssh-add to add every key to ssh-agent, is it possible to add those keys automatically as soon as they are asked by ssh? Likewise agents launched by desktop environments do?

EDIT: What is the difference of agents launched by desktop environments (eg. forked from gnome-keyring-daemon) from agents launched by command line that would "add" this behaviour?

In Mate sessions (Linux Mint) as soon as ssh adds its first key to the agent a new process shows up, the one which SSH_AUTH_SOCK seems to point to, however there is a point preceding "ssh" name (".ssh" instead of "ssh"). This process is launched by "gnome-keyring-daemon", check the process PIDs on the screenshot below:

enter image description here

  • @PhilipCouling Isn't it enough referring the keyring gnome-keyring-daemon?
    – Luciano
    Mar 19, 2019 at 12:54
  • The OP added gnome-keyring-daemon in response to my comment. Mar 19, 2019 at 15:33

1 Answer 1


Sufficiently recent versions of ssh (7.2, released early 2016, and newer) have an option AddKeysToAgent which does just that:


Specifies whether keys should be automatically added to a running ssh-agent(1). If this option is set to yes and a key is loaded from a file, the key and its passphrase are added to the agent with the default lifetime, as if by ssh-add(1). If this option is set to ask, ssh(1) will require confirmation using the SSH_ASKPASS program before adding a key (see ssh-add(1) for details). If this option is set to confirm, each use of the key must be confirmed, as if the -c option was specified to ssh-add(1). If this option is set to no, no keys are added to the agent. The argument must be yes, confirm, ask, or no (the default).

As to differences in behaviour: the ssh-agent protocol follows a standard, which boils down to the following: the client (ssh, or ssh-add, or anybody else interested) knows who to talk to by looking at the environment variable SSH_AUTH_SOCK. The protocol, slightly simplified, has the following operations:

  1. key management operations: add, remove, list available keys

  2. message operations: sign, encrypt, etc.

Usually, you'd use ssh-add for the first kind. But, as said, new sshs will add as well. When you ask about on-demand loading of keys: an agent might do something fancy when you ask for a list of available keys – the standard implementation requires you to add all the keys beforehand, but a desktop environment implementation might have keys in some wallet storage protected by a master password, and ask for the password when you first try to use any key. (Or maybe you mean keys are shared between different terminal windows? That's just a matter of getting the environment variable SSH_AUTH_SOCK into all your terminals, which is why it's good to start the agent in your session, so all terminals inherit the variable.)

  • That worked like a charm, thanks! But, there's still a question how do those "keyring-daemon" work changing ssh-agent behaviour?
    – Luciano
    Mar 15, 2019 at 18:18
  • I'm not sure what you mean by that. The daemons replace openssh's ssh-agent by their own, which also understands ssh-add. Mar 15, 2019 at 18:26
  • I've improved the question "EDIT" session. Hopefully, it really improves the question.
    – Luciano
    Mar 19, 2019 at 18:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .