Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • 1
    Not an answer, but, yes, there are some technical challenges around how to detect session inactivity when ssh-agent is agnostic to the type of session it is part of (e.g. tty session, X11 session, or something else). The one thing I would like to say if that your automated scripts probably shouldn't be depending on the key loaded in your agent. They should probably each have their own private key, which is authorized via forced commands on the appropriate servers to run only the specific remote commands that each script needs to run. That would of course let you run those from cron etc... Commented Mar 21, 2015 at 5:56
  • I don't expect ssh-agent to know when a session is inactive, but at least start the timeout from whenever the last signing operation occurred, not just whenever ssh-agent was launched. Also, I already use separate user accounts and keyfiles for each script role, sudoers allows only 1 or 2 commands to be sudo'd if necessary, and I've looked at lshell to lock things down further. But all that still doesn't absolve me from needing to protect my keyfiles: just because sudo zfs send is the only command allowed for a given key, that's a pretty powerful command for whoever wields that key! Commented Mar 21, 2015 at 7:43
  • Another workaround: use the ControlMaster/ControlPath/ControlPersist options (see man ssh_config) for your script. At least if its only connecting to one host. Commented Apr 24, 2015 at 18:56
  • That's an interesting suggestion and it did teach me something (thanks!) but doesn't seem to solve anything if I'm still going to have ssh-agent keep my keys loaded until I reboot (which could be weeks). Commented Apr 27, 2015 at 7:15