Manage SSH Keys with ssh-agent
In this step, you will learn how to manage your SSH keys using ssh-agent. The ssh-agent is a program that runs in the background and holds your private keys in memory. This is particularly useful when your private keys are protected by a passphrase. Instead of typing the passphrase every time you use the key, you type it once when you add the key to the ssh-agent, and then the agent handles the authentication for you for the duration of your session.
Although you generated a key without a passphrase in the previous step, we will now create a new key with a passphrase to demonstrate the utility of ssh-agent.
First, generate a new SSH key pair with a passphrase. We will name this key id_rsa_passphrase to distinguish it from the default id_rsa key.
ssh-keygen -f ~/.ssh/id_rsa_passphrase
You will be prompted to enter a passphrase. For this lab, use mypassphrase as the passphrase.
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): mypassphrase
Enter same passphrase again: mypassphrase
Your identification has been saved in /home/labex/.ssh/id_rsa_passphrase
Your public key has been saved in /home/labex/.ssh/id_rsa_passphrase.pub
The key fingerprint is:
SHA256:BuSxVlJb1lsiUFi2I5DAvyL01fJ5d480LT86dgtcHEg labex@6846375f1c0e35fea6cb03e6
The key's randomart image is:
+---[RSA 3072]----+
| ...=o+=*. E |
| .o.*.=..+ o |
| .=.o o. = . |
| . .+... .. . .|
| . . . +S. + |
| . o ..o . o * .|
| . . . . = * |
| oooo|
| ..+.o|
+----[SHA256]-----+
Note: If you accidentally press Enter without typing a passphrase, the key will be created without one. In that case, you can delete the files and run the command again, making sure to enter mypassphrase when prompted.
Now, let's copy this new public key to localhost so you can use it for authentication.
ssh-copy-id -i ~/.ssh/id_rsa_passphrase.pub labex@localhost
Since you already have passwordless authentication set up with your default key, the command may not prompt for a password and will use your existing authentication:
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/labex/.ssh/id_rsa_passphrase.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'labex@localhost'"
and check to make sure that only the key(s) you wanted were added.
Now, try to connect to localhost using this new key. You will need to specify the private key file using the -i option.
ssh -i ~/.ssh/id_rsa_passphrase labex@localhost
If you set a passphrase for the key, you will be prompted for it. However, if you accidentally created the key without a passphrase (as shown in the example output), you will be logged in directly:
Last login: Mon Jun 9 01:39:25 2025 from 47.251.66.143
[labex@host ~]$
You are logged in. Now, exit the session:
exit
exit
Connection to localhost closed.
[labex@host ~]$
Note: If your key doesn't have a passphrase, you can still continue with the ssh-agent demonstration to understand how it works, even though it won't prompt for a passphrase in this case.
First, start the ssh-agent in your current shell session. The eval command is used to properly set the environment variables that ssh-agent outputs.
eval "$(ssh-agent)"
Agent pid 1024
The output will show the process ID (PID) of the ssh-agent.
Next, add your private key (id_rsa_passphrase) to the ssh-agent.
ssh-add ~/.ssh/id_rsa_passphrase
If your key has a passphrase, you will be prompted for it. If not, the key will be added directly:
Identity added: /home/labex/.ssh/id_rsa_passphrase (labex@6846375f1c0e35fea6cb03e6)
Now that the key is added to the ssh-agent, try connecting to localhost again using the same key.
ssh -i ~/.ssh/id_rsa_passphrase labex@localhost
You should be able to connect without being prompted for a passphrase (whether your key has one or not, since it's now managed by the agent):
Last login: Mon Jun 9 01:39:49 2025 from 127.0.0.1
[labex@host ~]$
You have successfully used ssh-agent to manage your SSH key.
Important Note: The ssh-agent environment variables are only available in the shell session where you started it. If you're in an SSH session, you need to exit back to your local shell to use ssh-add commands.
Exit the SSH session first:
exit
exit
Connection to localhost closed.
[labex@host ~]$
Now, to see the keys currently loaded in your ssh-agent, you can use ssh-add -l:
ssh-add -l
If the agent is running and has keys loaded, you'll see output like:
3072 SHA256:BuSxVlJb1lsiUFi2I5DAvyL01fJ5d480LT86dgtcHEg /home/labex/.ssh/id_rsa_passphrase (RSA)
However, if you see an error message like "Could not open a connection to your authentication agent", it means the agent environment variables are not set in your current session.
To remove all identities from the ssh-agent, use ssh-add -D:
ssh-add -D
If the agent is accessible, you'll see:
All identities removed.
However, if you see "Could not open a connection to your authentication agent", it means the agent environment is not available in your current session.
Now, if you try to connect again and your key has a passphrase, you will be prompted for it because the key has been removed from the agent:
ssh -i ~/.ssh/id_rsa_passphrase labex@localhost
If your key has a passphrase, you'll see:
Enter passphrase for key '/home/labex/.ssh/id_rsa_passphrase':
If your key doesn't have a passphrase, you'll still be able to connect directly. Press Ctrl+C to cancel the connection attempt if prompted for a passphrase.
Finally, to stop the ssh-agent process, you can use ssh-agent -k:
ssh-agent -k
If the SSH_AGENT_PID environment variable is not set, you may see:
SSH_AGENT_PID not set, cannot kill agent
This is normal if the agent was started in a different shell session or if the environment variables were not properly exported.
