I have ssh public keys set up on my computers. They have passphrases. Whenever I need to, e.g. push to github, I have to type in the passphrase. Each time. And I'd rather ssh remembered on subsequent accesses.

ssh-agent/keychain seem to just about fit the bill, except they bother me for the passphrase when I log in (when I might not be sure I need to use my ssh keys), not when I'm trying to use ssh.

Is there some feature in either of those tools or some other tool that would remember the ssh passphrase, but maybe grab it when I type it in for ssh instead of when the session opens?

I somehow got this working on a Fedora 16 box a while ago, but can't remember what I did.

  • This would be less of an issue if I just left my computers on, but that costs power, and power costs money, and I hate spending money. – Ellery Newcomer Feb 14 '13 at 4:14
  • Try setting it up with the passphrase being your password, so it can unlock keys automatically on login. – cpast Feb 14 '13 at 4:15

Here's what I used to solve this problem for ssh shells. I alias the ssh command to first check if the keys have been loaded and if not, load them first, then perform the ssh command:

alias ssh='[[ `ssh-add -l` == "The agent has no identities." ]] && ssh-add; ssh'

I put that in my .alias and source it from .bashrc

  • Welcome to Super User! This answer seems pretty solid, but you might consider expanding on some of the steps given a little, in case someone reading isn't as familiar with them as you are. Otherwise, good stuff. – Anaksunaman May 23 '18 at 10:08

This is the default behavior of GNOME Keyring's internal SSH agent.

Add these modules to the respective sections of your PAM configuration in /etc/pam.d/system-login (or, for GDM, gdm-password).

auth       optional   pam_gnome_keyring.so only_if=login,gdm-password


session    optional   pam_gnome_keyring.so only_if=login,gdm-password auto_start

This should be enough if you use GNOME (which starts the keyring daemon from XDG Autostart). If you're using any other environment, add this to your .xinitrc (for startx) or .xprofile (for gdm/lxdm/kdm):

    eval $(gnome-keyring-daemon --start)

If you run ssh-agent without providing it with a key, you can later run ssh-add the first time you need the key.


Use gpg-agent. It can handle SSH keys in addition to PGP keys, asks for your passphrase once only when you need it and uses pinentry for the input.

Add this to ~/.xinitrc or ~/.xprofile :

eval $(gpg-agent --enable-ssh-support --daemon)

After you logout/login, you will need to issue ssh-add to ask gpg-agent to handle your SSH key. This is needed only the first time you use gpg-agent, not after each login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.