SSH Cheatsheet

ssh-agent and Forwarding

Use this SSH reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

What ssh-agent Does

ssh-agent holds decrypted private keys in memory so you enter your passphrase once per session rather than on every connection.

Start and Use the Agent

# Start the agent and export its socket
eval "$(ssh-agent -s)"
# Agent pid 12345

# Add the default key
ssh-add

# Add a specific key
ssh-add ~/.ssh/id_ed25519

# Add with a custom TTL (key expires from agent after N seconds)
ssh-add -t 3600 ~/.ssh/id_ed25519    # expires in 1 hour

On macOS, the agent is managed by launchd and starts automatically. The Keychain integration:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519   # store passphrase in Keychain
ssh-add --apple-load-keychain                     # load Keychain passphrases

Put this in ~/.ssh/config to load keys automatically:

Host *
    AddKeysToAgent yes
    UseKeychain yes            # macOS only
    IdentityFile ~/.ssh/id_ed25519

Manage Keys in the Agent

# List loaded keys (fingerprint + comment)
ssh-add -l

# List loaded keys (full public key)
ssh-add -L

# Remove a specific key
ssh-add -d ~/.ssh/id_ed25519

# Remove ALL keys from agent
ssh-add -D

# Lock the agent (requires unlock passphrase)
ssh-add -x

# Unlock the agent
ssh-add -X

Agent Forwarding

Lets the remote server use your local agent's keys — so you can ssh from a remote machine to a third machine without copying your private key to the remote.

# Enable per-connection
ssh -A user@bastion

# Then from bastion:
ssh user@internal-host    # uses your local key via forwarding

Security warning: Agent forwarding lets anyone with root on the remote server hijack your agent socket and impersonate you. Only forward to servers you fully trust.

Enable in Config (Selectively)

Host bastion
    ForwardAgent yes

Host *.internal
    # Do NOT forward agent here — third-party servers

Check Forwarded Socket on Remote

echo $SSH_AUTH_SOCK      # should be set if forwarding is active
ssh-add -l               # lists your local agent's keys

Agent Forwarding vs ProxyJump

Approach	Private key location	Requires trust in middle host
`ForwardAgent yes`	Stays local; agent socket forwarded	Yes — root can hijack
`ProxyJump` / `-J`	Stays local; no socket forwarded	No

Prefer ProxyJump for reaching hosts behind a bastion. Reserve ForwardAgent for cases where the remote host itself needs to authenticate onward (e.g., running git commands on a CI box).

GPG Agent as SSH Agent

Some teams use GPG keys for SSH authentication:

# Add to ~/.bashrc / ~/.zshrc
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
gpgconf --launch gpg-agent

Systemd User Service (Linux — Persistent Agent)

# ~/.config/systemd/user/ssh-agent.service
[Unit]
Description=SSH key agent

[Service]
Type=simple
Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK
Restart=on-failure

[Install]
WantedBy=default.target

systemctl --user enable --now ssh-agent
echo 'export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket"' >> ~/.bashrc