Home / server / Questions / 1064341
In Process
rosstex
Asked: 2021-05-22 08:56:55 +0800 CST

Why isn't ssh-agent a background process by default?

  • 772

I have always wondered why such a basic feature (loading ssh keys for persistent usage) requires a clunky command to execute in the background of a cmdline. Why isn't ssh-agent a service (for example) by default? I assume there might be a security reason, but I'm curious to get other thoughts.

ubuntu ssh ssh-agent

2 Answers

  1. If you use ssh-agent an attacker can get the unencrypted key from memory. See https://www.netspi.com/blog/technical/network-penetration-testing/stealing-unencrypted-ssh-agent-keys-from-memory/

    • 0

  2. If ssh-agent is not running by default, the packager and system administrator have not set it up for you. As this is a matter of personal preference and important to security, not enabled by default makes sense to me. How tos exist of how to set it up in many environments.

    ssh-agent usage of printing out shell variables to evaluate is not typical of most programs.

    Other ssh agents may be have a friendlier experience. For example, on the desktop there exists Gnome Keyring SSH Agent.

    • 0