Differences

This shows you the differences between two versions of the page.

--- linux:ssh [2026/05/18 14:45] – [MANAGING PASSPHRASE] v1ctor
+++ linux:ssh [2026/05/18 15:07] (current) – [PUBLIC KEY AUTHENTICATION] v1ctor
@@ Line 2: / Line 2: @@
 ===== PUBLIC KEY AUTHENTICATION =====
+=== SSH AGENT ====
+''ssh-agent'' is a background process that holds your decrypted private keys in memory so you don't have to type the passphrase every time you SSH somewhere. Private SSH keys should be encrypted on disk with a passphrase. Without an agent, every ssh, git pull, scp etc. would prompt you to type that passphrase to decrypt the key.
+How it works:
+  - Agent starts as a background process, listening on a unix socket. Its path is exported as $SSH_AUTH_SOCK.
+  - You run ssh-add <key> once — passphrase prompt, decrypted key goes into agent memory.
+  - When ssh connects somewhere, it checks $SSH_AUTH_SOCK, asks the agent for available keys, and asks the agent to sign the server's challenge.
+With agent **forwarding** (ssh -A bastion, or ForwardAgent yes in config), SSH forwards $SSH_AUTH_SOCK from your laptop into the bastion shell. When you then run ssh internal-server from the bastion.
+=== SSH KEYS ====
 SSH keeys come in pairs: