TOPIC SECURITY
SSH Keys & Agents passwordless, but safe
IN 10 SECONDS
SSH keys use public-key cryptography to authenticate logins. An SSH agent runs in memory to manage your private keys, decrypting them once with a passphrase so you don't enter it repeatedly.
GOTCHA Forwarding your SSH agent (ssh -A) to untrusted remote servers can let root users on those servers hijack your agent and authenticate as you.
HOW AGENT AUTHENTICATION FLOWS
01 Login challenge ssh client initiates connection; server sends a challenge encrypted with your public key.
02 Agent sign local ssh-agent uses your private key to sign the challenge and returns the signature.
03 Verification server checks signature with public key, granting access if valid.
POKE IT YOURSELF
ssh-add ~/.ssh/id_rsa — load your private key into the SSH agent
ssh-add -l — list all active keys managed by the agent
Drill this topic →
~65 sec read