Why should I kill ssh-agent on logout?

Question

I have set up ssh-agent on my macOS laptop, and a 24x7 running server. Why do I need to kill ssh-agent on every logout?

Source of my knowledge of ssh-agent: https://kb.iu.edu/d/aeww

eval `ssh-agent`    # Start ssh-agent
echo $SSH_AGENT_PID    # 20552 (Check ssh-agent is running)
ssh-add    # Add id_rsa key to ssh-agent
kill $SSH_AGENT_PID    # Kill ssh-agent on logout

Why is this last step required?

Methods to kill ssh-agent processes

The easiest way I've found to find all running shh-agent processes

ps ax | grep ssh-agent    # outputs details of processes

OR

pgrep ssh-agent    # outputs list of PIDs only

The easiest way I've found to kill all running ssh-agent processes

pkill ssh-agent

Answer 1

If you don't manually kill it off, the agent will stay resident in your system.

Aside from being untidy on general principle, this has two potential problems:

1. As Kusanalanda points out it means you will wind up spawning another ssh-agent processs every time you log in, which gets kind of sloppy on the process table even if their footprint is probably negligible.

2. More seriously, each of those processes will have your unlocked private keys in their memory. If an attacker were to gain access to your system and exploit a (hypothetical, I'm not currently aware any exist) bug in either kernel memory management or the ssh-agent code itself to potentially extract your private keys.

Sure, the last one is low probability, but it's just as easy to kill the process and remove the risk entirely.

Better safe than sorry.

Answer 2

You don't have to. But you probably want to at least make sure there are no unlocked keys in the agent's memory, and that you don't leave an excessive number of agents laying around.

For that, you could:

• Tell the agent to only keep the keys in memory for a limited amount of time (start it with ssh-agent -t 1800 for a 30 min timeout, or use ssh-add -t 1800 when adding the keys)
• Have the agent delete all keys when you log out (ssh-add -D from your logout scripts); and
• When logging in, check if an agent is already running, and use that instead of starting a new one. Below is one way to do that.

# .bashrc
start_ssh_agent() {
        if [ -e ~/.agent ]; then
                . ~/.agent
        fi
        ssh-add -l > /dev/null 2>&1
        if [ "$?" = "2" ] ; then
                # agent not running, start it
                ssh-agent -t 3600 |grep -v ^echo > ~/.agent
                . ~/.agent
                echo "Started SSH agent with PID $SSH_AGENT_PID"
        fi
}
start_ssh_agent

There are other ways too, of course. In particular, you could use a fixed path to the agent socket. See e.g. How do I get ssh-agent to work in all terminals?

On the other hand, if someone could get the keys from your SSH agent, i.e. read the program memory of your process, they could probably do other things too. Like changing the settings to disable the timeouts, or install a modified ssh-add that sends them a copy of the key and the password.