SSH Agent

The passphrase memory you actually want

If your private key has a passphrase (and it should), you'd otherwise type it every single SSH command. ssh-agent is a small daemon that holds your decrypted private keys in memory: type the passphrase once, the agent uses the key for the rest of your session. On macOS, you can layer the system Keychain on top of that so the passphrase persists across reboots, too.

Using ssh-agent

On macOS, ssh-agent is auto-started for your login session. On Linux, your desktop environment usually starts one — if not, eval "$(ssh-agent -s)" in your shell does it.

Agent forwarding (-A) and its trap

Agent forwarding (-A) lets a remote machine use your local agent — handy when you SSH into a bastion and from there need to reach an internal server with the same key. The trap: anyone with root on the intermediate host can use your forwarded agent socket to authenticate as you to anything else.

For hop-through scenarios, ProxyJump (Track 3) is almost always safer. -A only between machines you fully trust.

Code

Day-to-day agent commands·bash

# Start an agent (macOS does this automatically)
eval "$(ssh-agent -s)"

# Add your key (asks for passphrase)
ssh-add ~/.ssh/id_ed25519

# macOS — also store the passphrase in Keychain so it persists across reboots
ssh-add --apple-use-keychain ~/.ssh/id_ed25519

# What's loaded?
ssh-add -l

# Drop everything (e.g., before stepping away from a public Mac)
ssh-add -D

# Forward your agent for one connection
ssh -A you_username@bastion

Exercise

Run ssh-add -l. If it says "no identities," run ssh-add ~/.ssh/id_ed25519. SSH into a known host — passphrase shouldn't be asked again. Then on macOS try ssh-add --apple-use-keychain ~/.ssh/id_ed25519, log out, log back in, and ssh-add -l again — the key should still be loaded thanks to Keychain.