I have always though that ssh-agent
has some limitations. One of those limitations is that when invoked from .bashrc
or .zshrc
in the following way:
`eval ssh-agent`
will cause one ssh-agent
instance to be spawned for every shell, which is a waste of resources. An easy solution is to use Keychain, which is also described here.
Basically, Keychain is a wrapper for ssh-agent
. Keychain will start a ssh-agent
and tell it to load one or several private keys. Additionally, Keychain will create two shell scripts into ${HOME}/.keychains
named ${HOST}-sh
(for SH-compatible shells) and ${HOST}-csh
(for CSH-compatible shells) that can be sourced, for example, from within .bashrc
, .zshrc
or .cshrc
, in order to set up the environment variables required for ssh-agent
to be usable by other tools like ssh
.
A typical ${HOME}/.keychains/${HOST}-sh
file looks like this:
SSH_AUTH_SOCK=/tmp/ssh-AIVkg1MfHH/agent.942; export SSH_AUTH_SOCK; SSH_AGENT_PID=943; export SSH_AGENT_PID;
Adding the following lines at the end of .bashrc
or .zshrc
will get Keychain invoked automatically by the shell:
### KEYCHAIN ### /opt/local/bin/keychain ~/.ssh/id_dsa source ~/.keychain/${HOST}-sh
Keychain will search for an existing ssh-agent
process. If no existing ssh-agent
process exists, Keychain will spawn one telling it to load one or several private keys (passed as parameters to Keychain). Next, Keychain will update ${HOME}/.keychain/${HOST}-sh
and ${HOME}/.keychain/${HOST}-csh
to set up the proper environment variables and their corresponding values.
Kudos to Daniel Robbins — the original author — and Aron Griffis — the current Gentoo mantainer. This neat piece of software is extremely useful to me and I use it every day 🙂
Awesome post Felipe Alfaro Solana » Blog Archive » OpenSSH public-keys, ssh-agent and Keychain however hey I am getting a small problem we are not able to appear to be able to sign up your rss feed, I am using yahoo reader F.Y.I.! Rgds ! Rob Rasner IMDB
Hello there, I have loved your own educational site. We have bookmarked your internet site consequently, may sign in here and there. Thank you!