Wikipedia article probably has the best description:
The verification to the server is based on challenge-response
authentication. ssh connects to the server with a user name and the
request for a key. The ssh daemon gets the request and sends back a
challenge based on the public key stored in the authentication file.
ssh uses the private key to construct a key response, and sends it to
the waiting sshd on the other end of the connection. It does not send
the private key itself. The ssh daemon validates the key response, and
if valid, grants access to the system. ssh-agent simplifies this by
creating a socket that listens for SSH connections. The user simply
starts ssh-agent, telling it how to find their keys (if they are not
in the default location), enters the passphrase for each key to be
used, on a one-time basis, and then ssh-agent handles the rest every
time the user connects to a remote server.
Again verbatim from the wikipedia article:
... ssh-agent creates a socket and then checks the connections from ssh.
Everyone who is able to connect to this socket also has access to the
ssh-agent. The permissions are set as in a usual Linux or Unix system.
When the agent starts, it creates a new directory in /tmp with
restrictive permissions. The socket is located in the folder.
It's typically put in either a system or user's rc files such as
$HOME/.profile (for bash shells) so that the environment variables
ssh-agent set get incorporated into your environment completely.
On my Fedora 14 system it starts up pretty early as part of the X11 subsystem. In this file,
# Prefix launch of session with ssh-agent if available and not already running.
if [ -z "$SSH_AGENT_PID" ] && [ -x /usr/bin/ssh-agent ]; then
if [ "x$TMPDIR" != "x" ]; then
SSH_AGENT="/usr/bin/ssh-agent /bin/env TMPDIR=$TMPDIR"
$SSH_AGENT is then made use in other X11 start-up scripts such as here,
exec -l $SHELL -c "$SSH_AGENT $XCLIENTS_D/Xclients.$1.sh"
By incorporating it into here, the following environment variables are getting set as part of a parent shell, therefore all forked children should also have them, for example:
SSH_AUTH_SOCK=/tmp/ssh-PspRF18958/agent.18958; export SSH_AUTH_SOCK;
SSH_AGENT_PID=18959; export SSH_AGENT_PID;
There is a little more complexity to this but in a nutshell this is basically what's going on with
For example in GNOME,
ssh-agent is actually launch per user as a start-up application:
ssh-agent exists so that when your ssh keys are required you only have to unlock them one time with their passphrase (assuming they have one), and from then on they're available in their decrypted form in memory (RAM).