# How to maintain ssh-agent login session with Windows 10's new OpenSSH and PowerShell

On my Ubuntu machine, I simply use Keychain to maintain a single ssh-agent which stays logged in.

I'd like something similar to that on Windows now that OpenSSH is natively included. I was using Git Bash with the well-known if [ -z "\$SSH_AUTH_SOCK" ] ; then ... script but this resulted in many ssh agents being opened, I knew it was advised against (partly due to this blog post: http://rabexc.org/posts/pitfalls-of-ssh-agents) - which is what made me get Keychain for Ubuntu. Another reason for not using this any more is that I'm moving to PowerShell as my main shell.

But I'm not sure how to achieve the same kind of thing on Windows specifically with PowerShell and with Win32-OpenSSH.

Thanks!

You must configure OpenSSH Authentication Agent service to automatically start (or you can start it manually everytime when opening your powershell for the first time: Start-Service ssh-agent).

After that, you need to ssh-add C:\path\to\your\ssh\key\id_rsa only once. After that, everytime the ssh-agent is started, the key will be there. You can check with ssh-add -l.

EDIT: To have SSH agent to automatically start with Windows, you can run Set-Service ssh-agent -StartupType Automatic on a super-user powershell prompt.

• Could you please add details on how to get ssh-agent to start automatically? May 8, 2019 at 1:12
• @MarkWoon I just edited my answer with that. May 13, 2019 at 13:59
• This does not seem to work -- the Set-Service has no apparent effect, and the manual Start-Service, while it starts something, is also ineffective -- any ssh-add command thereafter fails with "communication with agent failed"... Jul 29, 2019 at 20:18
• * In the startmenu search for "Services" * Double click on "OpenSSH Authentication Agent" * Set the startup type to "Automatic" * Click "Start" * Click Ok and Exit * * Now go to PowerShell and add your key with "ssh-add" * After that the agent will remember your key when you need it :) Aug 30, 2019 at 7:38
• The agent doesn't remember my key just added. ssh-add followed by ssh-agent -l shows nothing. Oct 10, 2020 at 10:25

Not a full answer, but still a solution to the problem that brought me here. (I also see a comment from one other person here that seems to be the same problem.)

If you have Git for Windows or MinGW or anything else which might add GNU utilities to your Windows path, that can interfere with the OpenSSH for Windows binaries. For me, I had to remove ProgramFiles/Git/bin from my PATH environment variable and then restart PowerShell in order to get this to work. Prior to that I was getting "communication with agent failed"

In addition to what's covered here, I ran into an issue getting it to work with Git because apparently Git uses its own SSH executable by default. To solve this, you need to set core.sshCommand in your Git config to point to the OpenSSH executable installed by Windows:

git config --global core.sshCommand C:/Windows/System32/OpenSSH/ssh.exe


I knew it was advised against (partly due to this blog post: http://rabexc.org/posts/pitfalls-of-ssh-agents) - which is what made me get Keychain for Ubuntu.

In light of this argument I must warn you against using ssh-agent from the PowerShell port of openssh as it silently uses ondisk storage of your keys in the Registry. See my own question (and answer) where-does-windows-openssh-ssh-agent-service-secretly-store-private-keys for a full explanation.

Essentially there are 3 problems with it:

1. It stores secret keys ON DISK - never use in a shared or guest situation
2. (traces of) Secret keys remain ON DISK after deletion
3. PoweShell implementation does not conform to the openssh manual page ssh-agent.1 in key aspects of security.
• Welcome to Super User! Please quote the essential parts of the answer from the reference link(s), as the answer can become invalid if the linked page(s) change. Jul 16, 2021 at 20:46