Server gets killed due to increasing number of ssh-agent processes

Question

I have a deployment user that's running a cronjob tuning in every minute.

On the remote server (the deployment target) I didn't have my public keys available but instead got a Could not open a connection to your authentication agent on my deployment server on ssh-add.

I ended up putting this line to my .bashrc:

ps -u $(whoami) | grep ssh-agent &> /dev/null || (eval $(ssh-agent) && ssh-add)

Despite it shouldn't in my understanding, the cronjob opens a new ssh-agent everytime. After 14-16 hours the server runs out of memory after creating a kern log with lots of entries like this:

Aug 12 21:50:58 tools kernel: [64021.568750] [25668]  1000 25668     2654       81       9        0             0 ssh-agent

... and I have to restart it.

How can I limit the number of running ssh-agent processes to one or kill the process after ending the cronjob?

UPDATE The given answer works perfectly fine, I just found out that that i had another eval ssh-add within the crontab. I'm going to reward the given question with the bounty.

Answer 1

To kill the ssh-agent process, you can just simply use the ssh-agent -k command.

However, you might get the following error message:

SSH_AGENT_PID not set, cannot kill agent

It's related to the subshell that invoked by your command within parentheses. The parent shell can't see the variables that were generated in the subshell, making the SSH_AGENT_PID empty.

You can change the one-liner into:

ps -u $(whoami) | grep ssh-agent &> /dev/null
if [ $? -ne 0 ];then
    eval $(ssh-agent)
    ssh-add
fi
trap 'ssh-agent -k; exit' 0

The last line will kill the agent for you when you log out the system.

But please note that this only works with one session, let's say, if you login with second session, then the second session won't be blessed by the ssh-agent that you authorized in the first session. You will need to workaround it by exporting the SSH_AGENT_PID and SSH_AUTH_SOCK in the second session to make it work. You can do it by printing these two variable into a temporary file, and load it in .bashrc, a quick example:

ps -u $(whoami) | grep ssh-agent &> /dev/null
if [ $? -ne 0 ];then
    eval $(ssh-agent)
    ssh-add
    echo "export SSH_AGENT_PID=$SSH_AGENT_PID" > ~/.agent-profile
    echo "export SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> ~/.agent-profile
else
    source ~/.agent-profile
fi
trap 'ssh-agent -k; exit' 0

Have fun.

Edit:
Don't forget to kill all your ssh-agents before you try this in your .bashrc, otherwise it will fail to call ssh-agent as there is already a running one.