Protect private keys and use the agent

A private key file is a password that never changes and never expires. If someone copies it from a backup, a stolen laptop, or a careless scp, they are you on every server that trusts it.

The passphrase is what protects that file. It encrypts the private key on disk, so a copied file is useless without it. The passphrase is never sent anywhere. Your own computer uses it locally to unlock the key.

The annoying part is typing it for every connection. That is what the agent solves. ssh-agent holds unlocked keys in memory for your session. You type the passphrase once, and ssh asks the agent to sign instead of reading the file again.

Load the key

On macOS and most Linux desktops an agent is already running. Add the key:

ssh-add ~/.ssh/notes_server_ed25519

Enter passphrase for /Users/flavio/.ssh/notes_server_ed25519: 
Identity added: /Users/flavio/.ssh/notes_server_ed25519 (flavio notes-server operator)

Now check what the agent is offering on your behalf:

ssh-add -l

256 SHA256:9kLm3nQ7rT2vW5xY8zA1bC4dE6fG0hJ3kM7nP2qR5sU flavio notes-server operator (ED25519)

Run this command whenever a connection behaves strangely. Every key in that list gets offered to every server you connect to, unless you say otherwise. Too many keys and a server refuses you with Too many authentication failures before it sees the right one.

Limit what the agent holds

Load only the keys you need, and give them a lifetime:

ssh-add -t 3600 ~/.ssh/notes_server_ed25519

After an hour the agent forgets the key and you type the passphrase again. I like this for server keys. A key that stays unlocked for weeks on a laptop that gets carried around is a bigger risk than an extra passphrase prompt.

Remove a key when you are done:

ssh-add -d ~/.ssh/notes_server_ed25519

Now connect with IdentitiesOnly=yes and the key file:

ssh -o IdentitiesOnly=yes -i ~/.ssh/notes_server_ed25519 [email protected]

SSH asks for the passphrase directly, because the agent no longer has the key. Add it back and run the same command. No prompt this time. That is the difference between the two paths, and it is worth seeing once.

Two shortcuts to refuse

The first is removing the passphrase because prompts are annoying. Use the agent instead. That is exactly what it exists for.

The second is ssh -A, agent forwarding. It lets the remote server ask your local agent to sign things. Your key never leaves your machine, but anyone with root on that server can use your agent while you are connected. Never put ForwardAgent yes in a wildcard config block. Later we use ProxyJump for the case that tempts people into forwarding.

Try this on your own machine: list the agent, connect, remove the key, connect again, and watch where the passphrase prompt appears in each case.