I've set up an openSSH server on an ubuntu-server machine, and I configured it to use public/private key (without password). I want to require both password and key check when the client connects to the server, so I created the private key with a passphrase. Problem is, that the passphrase is required only on the first time the client tries to connect to the server, and any consecutive connections (from the same client) will connect automatically without asking for the passphrase again. An exception to that is when the client's computer reboots, but that's not what I want.

I have full control on the client's machine, so I decided to add a cron job with the command "ssh-add -D", which removes all the identities from the ssh agent on the client computer, which means the next time the client tries to connect, he will be asked to enter the passphrase as if it was the first time. I added this command to a cron job to run every hour (that would satisfy me, even that it means that not EVERY attempt to connect would require password).

Unfortunately, it appears that it doesn't do anything when the job executes. I checked that the job actually executes with adding more commands to it - while all the commands work as expected, only the ssh-add appears to malfunction.

I added the cron job with the following lines:

user@ubuntu:~$ crontab -u user -e

then I chose vim to edit, and added the line:

* * * * * ssh-add -D


What am I doing wrong?

Just on a side note: I'm very new to Linux (using ubuntu), so I may not understand some high-level concepts.. I'll appreciate if your answers will be simple :)

  • Check the mailbox of the user that the cronjob runs under. Since your cron job doesn't pipe to /dev/null your email should have the output of the ssh-add command.
    – Tim
    Commented Jul 30, 2013 at 15:48

3 Answers 3


Normally, the environment variables are different if a program runs from cron, so ssh-add does not find any ssh-agent.

Call instead the following script which tries all agents and set $SSH_AUTH_SOCK correctly:

for agent in /tmp/ssh-*/agent.*; do
    export SSH_AUTH_SOCK=$agent
    if ssh-add -l 2>&1 > /dev/null; then
        # working ssh-agent found
        ssh-add -D # delete all identities
  • Thanks for the effort to help, but that doesn't work. I tried to run the script without a cron job, and it just doesn't do anything (it seems that the if body is never executed). I move the ssh-add line just before the if statement, so it executes on every agent found in the for loop, and it outputs "All identities removed" several times, but it did not really reset the passpharse, i.e. I still able to connect to the server without it asking for a passphrase. (Ofcourse it doesnt work with cron job either).
    – rboy
    Commented Jul 30, 2013 at 17:44
  • 1
    The passphrase could be also saved by gnome-keyring or something else.
    – jofel
    Commented Jul 30, 2013 at 19:09
  • When I use just 'ssh-add -D' it works.. only with the script you provided it doesn't work... so I'm not sure it has something to do with other tools such as gnome-keyring... anyway, how do I reset passphrases that are cached in gnome-keyring (if any)?
    – rboy
    Commented Jul 30, 2013 at 19:56
  • @RB14 What is the value of SSH_AUTH_SOCK when ssh-add -D works? Commented Jul 30, 2013 at 23:03
  • well.. it's: /tmp/keyring-NMLc0Q/ssh Not sure if it has something to do with gnome-keyring, but it looks like it might.
    – rboy
    Commented Jul 31, 2013 at 11:13

Maybe it is sufficient to add

AddKeysToAgent yes

to the client's .ssh/config?


Jofel's answer and Gilles comment led me to do


from the command line, which reveals:


So, this works for me when run from crontab:

export SSH_AUTH_SOCK=/run/user/1000/keyring/ssh && ssh-add -D

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .