Introduction

If you use an SSH key protected by a passphrase to access your servers, you’ve probably run into the same annoyance: typing that passphrase every single time you connect gets old fast — and it gets in the way when you need to do something like clone a private Git repository on a remote machine using the keys that live only on your laptop.

This guide covers how to use an SSH key with a passphrase for SSH forwarding, so you can authenticate once per session and let ssh-agent handle the rest — securely, without ever copying your private key to another machine.

The Problem

Scenario 1: You’ve set up an SSH key with a passphrase to access all your servers. Re-entering that passphrase on every single connection is repetitive and slows you down.

Scenario 2: You want to clone a Git repository onto a remote machine, but that repository is only authorized for your laptop’s SSH key. You have two options:

  1. Copy your private key to the remote machine. This works, but it’s a real security risk — your private key should never leave the machine it was generated on.
  2. Use SSH agent forwarding. This lets the remote machine use your laptop’s SSH identity for authentication, without the private key ever being copied over.

The Solution: SSH Agent with Key Forwarding

ssh-agent is a background process that holds your decrypted private key in memory for the duration of your session, so you only need to enter your passphrase once. Combined with agent forwarding, it lets a remote server “borrow” your local identity to authenticate elsewhere — like pulling a private Git repo — without the key itself ever touching that server.

Step 1: Automate ssh-agent on Login

Add the following to your .bashrc file so the agent starts and loads your key automatically:

eval `ssh-agent -s`
ssh-add -K ~/.ssh/id_rsa

Here’s what each part does:

  • eval \ssh-agent -s` — launches the ssh-agent process and sets the environment variables ssh-add needs to communicate with it.
  • ssh-add -K ~/.ssh/id_rsa — adds your private key’s identity to the agent. The -K flag stores the passphrase in your system’s keychain, so you’re not prompted for it on every new login.

Note: The -K flag is macOS-specific (it integrates with the macOS Keychain). On Linux, omit -K — a plain ssh-add ~/.ssh/id_rsa will still cache the unlocked key in the running ssh-agent session, you’ll just be prompted for the passphrase once per session rather than having it persist across reboots.

Step 2: Make Sure .bashrc Actually Runs

On most Linux distributions, .bashrc runs automatically whenever you open a terminal, so no extra setup is needed.

If you’re using iTerm2 on macOS, .bashrc isn’t sourced by default in the same way — you’ll need to configure it explicitly:

  1. Open iTerm2 Preferences
  2. Go to Profiles → Command
  3. Under “Send text at start,” enter:
source ~/.bashrc

Step 3: Enable Agent Forwarding When You Connect

To forward your local agent (and its loaded keys) to a remote server, connect with the -A flag:

ssh -A user@remote-server

Once connected, any Git or SSH operation on that remote server that needs your key — like cloning a private repository — will authenticate using your laptop’s identity, without the private key ever being copied there.

Security note: Only forward your agent to servers you trust. If a remote server is compromised while your agent is forwarded to it, an attacker could potentially use your forwarded identity to authenticate elsewhere for the duration of that session.

Frequently Asked Questions

Does ssh-agent forwarding copy my private key to the remote server? No. Only the authentication requests are forwarded through a secure socket — the private key itself never leaves your local machine.

Do I need to enter my passphrase every time I open a new terminal? With -K on macOS, no — it’s cached in the keychain. On Linux, you’ll typically re-enter it once per ssh-agent session (e.g., after a reboot or logout), unless you set up an additional keychain integration.

Is agent forwarding safe to use on shared or untrusted servers? No — avoid forwarding your agent to any server you don’t fully trust, since a malicious actor with root on that server could hijack the forwarded socket during your session.

Conclusion

SSH agent forwarding solves a real trade-off: staying secure by never copying your private key around, while still avoiding the hassle of re-entering your passphrase constantly. A couple of lines in .bashrc to start ssh-agent and load your key, plus the -A flag when connecting, is all it takes to authenticate once and use that identity anywhere you need it including cloning private Git repos on remote machines.

Post Views: 212

Leave a Reply