1

I have created a private/public SSH key pair using ssh-keygen. I use this to authenticate to remote servers. However, I find that when I log in, ssh-add -l already lists my identity key even though I have not added it!

If I use the command ssh-add it prompts me for my passphrase and loads my identity key. If I then list my keys with ssh-add -l, it now shows two identity keys! These are obviously the same as both have the same fingerprint, but their descriptions are different (the automatically loaded one is "user@host (RSA)" and the one added using ssh-add is "/home/user/.ssh/id_rsa (RSA)").

So why does my identity key appear to be loaded without any action on my part, and why does ssh-add add the same key again? Obviously something must be doing this automatically, but what is it, and how can I stop it?

Improve this question

2 Answers 2

Reset to default
1

Using ssh-keygen creates a key ~.ssh/id_rsa or ~.ssh/id_dsa. These are the default file locations for ssh keys and are read in automatically. Use ssh-add when you need to add extra keys.

If you don't want a default key simply name your keys something other than id_rsa. This can be done when generating ssh-keygen -f keyname or simply by renaming the file.

Improve this answer
0

Ubuntu keychain could be doing the initial load of your identity. More likely, your ssh-agent itself is grabbing the identities it needs to make password-free ssh (and scp, rsync, sftp, etc) possible for the logged-in user. Ubuntu uses your desktop login credentials to allow the ssh-agent to load identities from any of the several default locations in ~/.ssh. Just like logging into a remote server, logging into your local desktop starts up the ssh-agent daemon.

Try pgrep ssh-agent and kill it if you like to enter your passwords a lot. But requiring passwords all the time is less secure than trusting the agent -- remembering them, keeping them secure, shoulder surfers, keyloggers, webcam peeping, history files, typing them at the wrong prompt and revealing them to the wrong server/daemon, ... the list goes on.

Improve this answer

You must log in to answer this question.