Straight forward way to run ssh-agent and ssh-add on login via SSH?

One alternative is to use Funtoo's Keychain. Then you can stick this one-liner in your bash shell:

eval $(keychain --eval id_rsa) 

That does the same thing (launches ssh agent, etc.), while also not running an ssh-agent process for each subshell. Instead it looks for "already running" instances you own and attaches you to them.

Another alternative is to add this to your .bashrc. This has the same advantage as Erik's answer (ensuring a single instance) but doesn't require an additional package.

# SSH Agent should be running, once runcount=$(ps -ef | grep "ssh-agent" | grep -v "grep" | wc -l) if [ $runcount -eq 0 ]; then echo Starting SSH Agent eval $(ssh-agent -s) fi 

This runs ssh-add if there is not at least 1 key loaded and sets a key timeout of 1 day:

ssh-add -l &>/dev/null if ! [ "$?" == 0 ]; then echo Adding keys... ssh-add -t 1d fi 

Same answer as @womblerone, but a little bit slimmer:

Run the ssh agent (if not already running):

# SSH Agent should be running, once if ! ps -ef | grep "[s]sh-agent" &>/dev/null; then echo Starting SSH Agent eval $(ssh-agent -s) fi 

Add the ssh-key if no keys are added yet

if ! ssh-add -l &>/dev/null; then echo Adding keys... ssh-add -t 1d fi 

A clean way to start the ssh-agent would be systemd: https://gist.github.com/magnetikonline/b6255da90606fe9c5c25d3333c98c90d

add the following to your ~/.bashrc or ~/.zshrc

export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket" if ! ssh-add -l &>/dev/null; then echo Adding keys... ssh-add -t 1d ~/.ssh/id_rsa fi 

logout and log back in

create the file /etc/systemd/user/ssh-agent.service with these contents:

[Unit] Description=SSH authentication agent [Service] ExecStart=/usr/bin/ssh-agent -a %t/ssh-agent.socket -D Type=simple [Install] WantedBy=default.target 

and execute this command with your user account:

systemctl --user enable --now ssh-agent 

check if it worked:

ssh-add -Lexport SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket" 

if ! ssh-add -l &>/dev/null; then echo Adding keys... ssh-add -t 1d /.personal fi

If you used both zsh (Oh-my-zsh) and bash I have written this this little script that is compatible with it.

SHORT_HOST="${HOSTNAME/.*/}" ssh_env_cache="$HOME/.ssh/environment-$SHORT_HOST" # Oh-my-zsh compatible bash ssh-agent start script function _start_agent() { if [[ -f "$ssh_env_cache" ]]; then . "$ssh_env_cache" > /dev/null fi if [[ -S "$SSH_AUTH_SOCK" ]]; then return 0 fi echo "Starting ssh-agent ..." ssh-agent -s | sed '/^echo/d' > "$ssh_env_cache" chmod 600 "$ssh_env_cache" . "$ssh_env_cache" > /dev/null } _start_agent unset ssh_env_cache unset -f _start_agent ssh-add ~/.ssh/id_rsa 

On the plus side this will prevent spawning another ssh-agent every time you start a bash session.

Also keep in mind if you have ssh connection keep-alive you need to delete existing connection files before -A takes effect. Delete any ssh connection files in /tmp/[host].

If you want to unlock the key:

1. no more than once per login
2. on-demand (i.e. when you actually are trying to use the key)

You can do the following (tested on Ubuntu):

apt install keychain 

in your .bashrc/.zshrc add:

eval $(keychain --eval --quiet) 

Note that unlike in many other answers on StackExchange, we do not specify any keys in this step. Keychain only makes sure the one and only one instance of the ssh-agent is started.

Then, in your .ssh/config add AddKeysToAgent yes. This loads the key into the ssh-agent the first time we use it. Your config should thus look something like this:

Host * AddKeysToAgent yes Host my-server HostName example.com IdentityFile ~/.ssh/id_rsa IdentitiesOnly yes