Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I sometimes use ssh to connect to a remote machine. Once I enter the passphrase once, I can use ssh again without the passphrase, but even if I come back a long time later, it still doesn't ask me, because the key is cached. I can do ssh-add -D to remove the key from the cache, but I want that to happen automatically after, say, 1 hour. How can I do that?

share|improve this question
up vote 10 down vote accepted

The program that caches your ssh keys is the ssh-agent program, if you look at the man page you can see this relivent option:

-t life  Set a default value for the maximum lifetime of identities added
         to the agent.  The lifetime may be specified in seconds or in a
         time format specified in sshd_config(5).  A lifetime specified
         for an identity with ssh-add(1) overrides this value.  Without
         this option the default maximum lifetime is forever.

You can edit the ssh-agent program in your startup programs. Go to System > Preferences > Startup Programs, look for the SSH Key Agent and append -t 3600 to the comman. This will expire your keys in one hour.

alt text

You will need to restart your session (log out and back in) for it to take effect. You can also do a similar thing for your gpg key which also can be set in an agent program which can be launched the same way (but isn't installed by default) just in case you get sick of typing in your gpg pass-phrase for package building or emailing.

share|improve this answer

Unfortunately the selected answer doesn't seem valid (anymore): the GNOME Keyring doesn't honor the lifetime option due to bug 525574. A workaround is for example to disable GNOME Keyring for SSH keys, but then you'd have to manually ssh-add -t 60m the key upon use (or script that).

share|improve this answer

You can add a cron job for that.

share|improve this answer
Can you expand this answer to explain how? (And also, if possible, why one would choose to do this given that it's possible to set up self-expiring keys)? – Eliah Kagan Sep 3 '12 at 21:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.