---
title: How to configure ssh-agent, agent forwarding & protocol
description: Here is How to configure ssh-agent, agent forwarding & protocol. ssh-agent is not automatically started at login, it can be started manually.
---

[Academy ](https://www.ssh.com/academy)

# [How to configure ssh-agent, agent forwarding & protocol](https://www.ssh.com/academy/ssh/agent)

 Written by [Admin](https://www.ssh.com/academy/author/admin) | Aug 27, 2019 4:00:00 AM

The `ssh-agent` is a helper program that keeps track of users' [identity keys](https://www.ssh.com/academy/ssh/identity-key) and their [passphrases](https://www.ssh.com/academy/ssh/passphrase). The agent can then use the keys to log into other servers without having the user type in a password or passphrase again. This implements a form of single sign-on (SSO).

The SSH agent is used for [SSH public key authentication](https://www.ssh.com/academy/ssh/public-key-authentication). It uses [SSH keys](https://www.ssh.com/academy/ssh-keys) for authentication. Users can create SSH keys using the [ssh-keygen](https://www.ssh.com/academy/ssh/keygen) command and install them on servers using the [ssh-copy-id](https://www.ssh.com/academy/ssh/copy-id) command.

### Contents

[Starting `ssh-agent`](https://www.ssh.com/academy/ssh/agent?hs_amp=true#starting-ssh-agent) [Adding SSH keys to the Agent](https://www.ssh.com/academy/ssh/agent?hs_amp=true#adding-ssh-keys-to-the-agent) [SSH Agent Forwarding](https://www.ssh.com/academy/ssh/agent?hs_amp=true#ssh-agent-forwarding) [Running `ssh-agent`](https://www.ssh.com/academy/ssh/agent?hs_amp=true#running-ssh-agent) [Further Reading](https://www.ssh.com/academy/ssh/agent?hs_amp=true#further-reading)

## Starting `ssh-agent`

On most Linux systems, `ssh-agent` is automatically configured and run at login, and no additional actions are required to use it. However, an [SSH key](https://www.ssh.com/ssh/key) must still be created for the user.

If `ssh-agent` is not automatically started at login, it can be started manually with the command

```
eval `ssh-agent`
```

The `ssh-agent` command outputs commands to set certain environment variables in the shell. The commands output by default are compatible with `/bin/sh` and `/bin/bash`. To output commands for the C-shell (`/bin/csh` or `/bin/tcsh`), add `-c`.

The easiest way to check is to check the value of the `SSH_AGENT_SOCK` environment variable. If it is set, then the agent is presumably running. It can be checked by

```
echo $SSH_AGENT_SOCK
```

Also, to allow key-based logins to servers, [public key authentication](https://www.ssh.com/ssh/public-key-authentication) must be enabled on the server. In [OpenSSH](https://www.ssh.com/academy/ssh/openssh) it is enabled by default. It is controlled by the `PubkeyAuthentication` option in [sshd_config](https://www.ssh.com/academy/ssh/sshd_config).

## Adding SSH keys to the Agent

By default, the agent uses SSH keys stored in the `.ssh` directory under the user's home directory. The [ssh-add](https://www.ssh.com/academy/ssh/add-command) command is used for adding identities to the agent. In the simplest form, just run if without argument to add the default files `~/.ssh/id_rsa`, `.ssh/id_dsa`, `~/.ssh/id_ecdsa`, `~/.ssh/id_ed25519`, and `~/.ssh/identity`. Otherwise, give it the name of the private key file to add as an argument.

The following command will list private keys currently accessible to the agent:

```
ssh-add -l
```

## SSH Agent Forwarding

Furthermore, the [SSH protocol](https://www.ssh.com/academy/ssh/protocol) implements *agent forwarding*, a mechanism whereby an [SSH client](https://www.ssh.com/academy/ssh/client) allows an [SSH server](https://www.ssh.com/academy/ssh/server) to use the local `ssh-agent` on the server the user logs into, as if it was local there. When the user uses an SSH client on the server, the client will try to contact the agent implemented by the server, and the server then forwards the request to the client that originally contacted the server, which further forwards it to the local agent. This way, `ssh-agent` and agent forwarding implement single sign-on that can progress transitively.

A wonderful feature of the single sign-on provided by SSH is that it works independent of organizational boundaries and geography. You can easily implement single sign-on to servers on the other side of the world, in cloud services, or at customer premises. No central coordination is needed.

To use agent forwarding, the `ForwardAgent` option must be set to `yes` on the client (see [ssh_config](https://www.ssh.com/academy/ssh/config)) and the `AllowAgentForwarding` option must be set to `yes` on the server (see [sshd_config](https://www.ssh.com/ssh/sshd_config/)).

## Running `ssh-agent`

The `ssh-agent` command is usually run from initialization scripts at login, such as from `/etc/X11/Xsession.d/90x11-common_ssh-agent` on Linux Mint LMDE. Alternatively, any user can configure it to be run from, e.g., the user's `~/.xsession` file or `~/.profile`.

The agent outputs environment variable settings that this puts in place. The `SSH_AUTH_SOCK` environment variable is set to point to a unix-domain socket used for communicating with the agent, and the `SSH_AGENT_PID` environment variable is set to the process ID of the agent. To get the environment variables set in the user's shell environment, the agent is usually run with something like the following:

```
eval `ssh-agent`
```

The `ssh-agent` command accepts the following options:

**-a bind_address**

Forces to bind the Unix domain socket to the given file path, instead of the default socket.

**-c**

Forces generation of C-shell commands on stdout. By default the shell is automatically detected.

**-d**

Enables debug mode.

**-E fingerprint_hash** Specifies which algorithm to use for generating SSH key fingerprints. Valid values include `md5` and `sha256`.

**-k**

Kills the currently running agent.

**-s**

Forces generation of Bourne shell (`/bin/sh`) commands on stdout. By default the shell is automatically detected.

**-t life**

Specifies a maximum number of seconds that identities are kept in the agent. The value is in seconds, but can be suffixed by `m` for minutes, `h` for hours, `d` for days, and `w` for weeks. Without this option, the agent keeps the keys in its memory as long as it runs. This can be overridden when running the [ssh-add](https://www.ssh.com/ssh/add) command.

## Further Reading

- [SSH key management](https://www.ssh.com/academy/iam/ssh-key-management)
- [Original agent protocol Internet-Draft (2001)](https://tools.ietf.org/html/draft-ietf-secsh-agent-00)
- [Newer agent protocol Internet-Draft (2016)](https://tools.ietf.org/html/draft-miller-ssh-agent-00)

[View full post](https://www.ssh.com/academy/ssh/agent)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Admin"
  },
  "dateModified" : "2025-04-30T13:00:55.632Z",
  "datePublished" : "2019-08-27T04:00:00Z",
  "headline" : "ssh-agent: How to configure ssh-agent, agent forwarding, & agent protocol",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.ssh.com/academy/ssh/agent",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Academy"
  }
}
```