2005-02-14 00:00:02 +00:00
|
|
|
.TH SSH-AGENT 1
|
|
|
|
|
.SH NAME
|
|
|
|
|
ssh-agent \- SSH authentication agent
|
|
|
|
|
.SH SYNOPSIS
|
|
|
|
|
.B ssh-agent
|
|
|
|
|
[
|
|
|
|
|
.B -l
|
|
|
|
|
]
|
|
|
|
|
.I factotum-service
|
|
|
|
|
.SH DESCRIPTION
|
|
|
|
|
.I Ssh-agent
|
|
|
|
|
presents
|
|
|
|
|
.IR factotum (4)
|
|
|
|
|
using the interface that
|
|
|
|
|
.IR ssh (1)
|
|
|
|
|
requires.
|
|
|
|
|
.PP
|
|
|
|
|
Once
|
|
|
|
|
.I ssh-agent
|
|
|
|
|
and
|
|
|
|
|
.I factotum
|
|
|
|
|
are running, the standard Unix SSH client
|
|
|
|
|
can use
|
|
|
|
|
.I ssh-agent
|
|
|
|
|
(and, indirectly,
|
|
|
|
|
.IR factotum )
|
|
|
|
|
to authenticate to remote systems using RSA or DSA keys.
|
|
|
|
|
.PP
|
|
|
|
|
.I Ssh
|
|
|
|
|
accesses
|
|
|
|
|
.I ssh-agent
|
2005-03-21 17:27:51 +00:00
|
|
|
via a Unix socket named
|
|
|
|
|
.B ssh-agent.socket
|
|
|
|
|
in the name space directory
|
|
|
|
|
(see
|
|
|
|
|
.IR intro (4)).
|
|
|
|
|
Note that although the socket is posted in the name space
|
|
|
|
|
directory, it is not for 9P conversations.
|
2005-02-14 00:00:02 +00:00
|
|
|
.I Ssh
|
2005-03-21 17:27:51 +00:00
|
|
|
expects the name of this socket to be in the environment as
|
2005-02-14 00:00:02 +00:00
|
|
|
.BR $SSH_AGENT_SOCK ,
|
|
|
|
|
and expects the agent to be running with process id
|
|
|
|
|
.BR $SSH_AGENT_PID .
|
|
|
|
|
.I Ssh-agent
|
|
|
|
|
prints shell commands to set these two variables
|
|
|
|
|
before forking itself into the background.
|
|
|
|
|
It is typically invoked inside a shell
|
|
|
|
|
.B eval
|
|
|
|
|
construct; see the examples below.
|
|
|
|
|
The
|
|
|
|
|
.B -e
|
|
|
|
|
option causes
|
|
|
|
|
.I ssh-agent
|
|
|
|
|
to include
|
|
|
|
|
.B export
|
|
|
|
|
commands to put the variables into the environment of future programs.
|
|
|
|
|
.PP
|
|
|
|
|
If the
|
|
|
|
|
.B -l
|
|
|
|
|
option is given,
|
|
|
|
|
.I ssh-agent
|
|
|
|
|
lists the usable
|
|
|
|
|
.I factotum
|
|
|
|
|
keys in the standard SSH format, suitable for creating an
|
|
|
|
|
.B authorized_keys
|
|
|
|
|
file.
|
|
|
|
|
.PP
|
|
|
|
|
.I Ssh-agent
|
|
|
|
|
connects to
|
|
|
|
|
.I factotum
|
|
|
|
|
by accessing
|
|
|
|
|
.I factotum-service
|
|
|
|
|
(default
|
|
|
|
|
.RB ` factotum ')
|
|
|
|
|
in the current name space.
|
|
|
|
|
.PP
|
|
|
|
|
There is a Unix program called
|
|
|
|
|
.I ssh-agent
|
|
|
|
|
that manages SSH keys itself.
|
|
|
|
|
Invoke this one with
|
|
|
|
|
.B 9
|
|
|
|
|
.BR ssh-agent ;
|
|
|
|
|
see
|
|
|
|
|
.IR 9 (1).
|
|
|
|
|
.SH EXAMPLES
|
|
|
|
|
Assume
|
|
|
|
|
.IR factotum (4)
|
|
|
|
|
is already running and initialized with keys.
|
|
|
|
|
.PP
|
|
|
|
|
Start a new agent, copying the commands by hand:
|
|
|
|
|
.IP
|
|
|
|
|
.EX
|
|
|
|
|
$ 9 ssh-agent -e
|
|
|
|
|
SSH_AUTH_SOCK=/tmp/ssh-405795003d7ee27a/agent.4233;
|
|
|
|
|
export SSH_AUTH_SOCK;
|
|
|
|
|
SSH_AGENT_PID=4233;
|
|
|
|
|
export SSH_AGENT_PID;
|
|
|
|
|
$ SSH_AUTH_SOCK=/tmp/ssh-405795003d7ee27a/agent.4233;
|
|
|
|
|
$ export SSH_AUTH_SOCK;
|
|
|
|
|
$ SSH_AGENT_PID=4233;
|
|
|
|
|
$ export SSH_AGENT_PID;
|
|
|
|
|
$
|
|
|
|
|
.EE
|
|
|
|
|
.PP
|
|
|
|
|
Start the agent from
|
|
|
|
|
.IR sh (1):
|
|
|
|
|
.IP
|
|
|
|
|
.EX
|
|
|
|
|
$ eval `9 ssh-agent -e`
|
|
|
|
|
$
|
|
|
|
|
.EE
|
|
|
|
|
.PP
|
|
|
|
|
Start the agent from
|
|
|
|
|
.IR rc (1):
|
|
|
|
|
.IP
|
|
|
|
|
.EX
|
|
|
|
|
% eval `{9 ssh-agent}
|
|
|
|
|
%
|
|
|
|
|
.EE
|
|
|
|
|
.PP
|
|
|
|
|
Use the agent to connect to a remote system:
|
|
|
|
|
.IP
|
|
|
|
|
.EX
|
|
|
|
|
% ssh tux
|
|
|
|
|
tux% ^D
|
|
|
|
|
%
|
|
|
|
|
.EE
|
|
|
|
|
.SH SOURCE
|
|
|
|
|
.B \*9/src/cmd/auth/ssh-agent.c
|
|
|
|
|
.SH SEE ALSO
|
|
|
|
|
.IR ssh (1),
|
|
|
|
|
.IR rsa (1),
|
|
|
|
|
.IR factotum (4)
|
|
|
|
|
.SH BUGS
|
|
|
|
|
A surprise rather than a bug:
|
|
|
|
|
.I ssh-agent
|
|
|
|
|
connects to factotum on demand, so it can be
|
|
|
|
|
started before
|
|
|
|
|
.I factotum
|
|
|
|
|
is running and need not be restarted just because
|
|
|
|
|
.I factotum
|
|
|
|
|
is.
|
