what is `ssh-agent bin/bash` and why I have to `ssh-add` everytime

Question

I have to run the following commands each time I restart:

ssh-agent /bin/bash
ssh-add ~/.ssh/key_rsa

First question is why is /bin/bash necessary and what it is used for?

Second, Is it ok I run these commands every time on restart, or should I put this in .bashrc or somewhere so I don't have to ssh-add everytime.

Note that I use screen and every screen tab is different and I have to run these commands for every screen tab.

Edit:

For example when I need to push to github I need to do ssh-add ~/.ssh/github_rsa, but this doesn't work unless I do ssh-agent /bin/bash first.

This might be related to screen because plain ssh-agent doesn't work, and ssh-agent is already running, yet I have to do ssh-agent /bin/bash.

Answer 1

ssh-agent is a daemon that caches the decrypted ssh key in memory when you ssh-add it so that you don't have to type in the password to decrypt it each time ssh tries to use it for authentication. It being cached in memory means that the next time ssh-agent is started the key has to be decrypted and added to the agent again, which is why you need to ssh-add it again.

The /bin/bash part isn't actually necessary. Normally when you start ssh-agent it will print some environment variables to stdout which are meant to be evaled so that ssh knows where the ssh-agent socket is. If you instead give ssh-agent a command when you start it, it will run that command with the environment variables set instead.

This means that the bash instance you're using after running the command is a subshell of the one you were using before. The issue with adding that to your .bashrc is that the new shell ssh-agent starts would run ssh-agent again, causing a recursive loop, which you don't want. Instead you might want to just start ssh-agent in your .bash_profile and eval the output instead of starting a subshell, and then use ssh-add yourself manually once each time you log in.

Another option would be to use the GNOME Keyring's SSH agent emulation instead of using ssh-agent. Unlike ssh-agent that doesn't save your passphrase, the GNOME Keyring will store the passphrase to the key in a keyring so you don't have to add keys manually.

Answer 2

I recommend you use keychain http://www.funtoo.org/Keychain

Keychain helps you to manage ssh and GPG keys in a convenient and secure manner. It acts as a frontend to ssh-agent and ssh-add, but allows you to easily have one long running ssh-agent process per system, rather than the norm of one ssh-agent per login session.

Firstly you would install it according to your distribution for debian/ubuntu

apt-get install keychain

Then add the following to ~/.bashrc file:

eval `keychain --eval id_rsa`