|This article needs additional citations for verification. (May 2010)|
SSH is a protocol allowing secure remote login to a computer on a network using public-key cryptography. SSH client programs (such as
ssh from OpenSSH) typically run for the duration of a remote login session and are configured to look for the user's private key in a file in the user's home directory (e.g.,
.ssh/id_rsa). For added security (for instance, against an attacker that can read any file on the local filesystem), it is common to store the private key in an encrypted form, where the encryption key is computed from a passphrase that the user has memorized. Because typing the passphrase can be tedious, many users would prefer to enter it just once per local login session. The most secure place to store the unencrypted key is in program memory, and in Unix-like operating systems, memory is normally associated with a process. A normal SSH client process cannot be used to store the unencrypted key because SSH client processes only last the duration of a remote login session. Therefore, users run a program called ssh-agent that runs the duration of a local login session, stores unencrypted keys in memory, and communicates with SSH clients using a Unix domain socket.
ssh-agent creates a socket and then checks the connections from
ssh. Everyone who is able to connect to this socket also has access to the
ssh-agent. The permissions are set as in a usual Linux or Unix system. When the agent starts, it creates a new directory in
/tmp with restrictive permissions. The socket is located in the folder.
There is a procedure that may prevent malware from using the
ssh-agent socket. If the
ssh-add -c option is set when the keys are imported into the
ssh-agent, then the agent requests a confirmation from the user using the program specified by the
SSH_ASKPASS environment variable, whenever
ssh tries to connect.
On the local system, it is important that the root user is trustworthy, because the root user can, amongst other things, just read the key file directly. On the remote system, if the
ssh-agent connection is forwarded, it is also important that the root user is trustworthy, because they can access the agent socket (though not the key).
There are many different programs that perform the same functionality as the OpenSSH ssh-agent, some with very different user interfaces. PuTTY, for example, uses a graphical user interface in its bundled Pageant ssh-agent.
There are tools designed to provide key-agent functionality for both symmetric and asymmetric keys; these usually provide ssh-agent functionality as one of their application interfaces. Examples include GNOME Keyring and KWallet.
Some monolithic SSH clients include the ability to remember SSH passphrases across sessions. Examples include: SecureCRT.
Status on OS X
- Dribin, Dave (21 August 2007). "SSHKeychain Warning". Dave Dribin's Blog.