Add time gated SSH key script

[ulises-c]

SSH Agent Passphrase Cooldown

Setup so the SSH key passphrase is asked once per login, then cached
until logout/reconnect or 4 hours pass, whichever comes first.

Machine: Ubuntu, accessed via tty/SSH login. Login shell: bash (reads ~/.profile).

Key

• ~/.ssh/<key> — ED25519, passphrase-protected (public half: <key>.pub)

What was changed

1. ~/.ssh/config

Auto-load the key on first git/ssh use and cap its in-agent lifetime at 4h:

Example

Host github.com
  AddKeysToAgent 4h
  IdentityFile /home/ulises/.ssh/github

(Changed from AddKeysToAgent yes. ssh -G github.com confirms addkeystoagent 14400.)

2. ~/.profile

Start a per-login ssh-agent with a 4h default key lifetime, and kill it on logout:

# ssh-agent scoped to this login session; keys expire after 4h.
# First git/ssh use prompts for the passphrase, then it is cached until
# the agent dies (logout/reconnect) or 4 hours pass, whichever comes first.
if [ -z "$SSH_AUTH_SOCK" ]; then
    eval "$(ssh-agent -s -t 4h)" >/dev/null
    trap 'ssh-agent -k >/dev/null 2>&1' EXIT
fi

Resulting behavior

• New SSH/console login → fresh agent, no key loaded.
• First git pull/push to → prompted for passphrase once; key loads into agent.
• Next 4 hours, same session → no prompts.
• After 4h, or on logout/reconnect → key dropped, prompted again. Whichever comes first wins.

Why two layers

• Per-login agent (dies on logout) handles the reconnect condition.
• -t 4h on the agent + AddKeysToAgent 4h in config handle the time condition.

Activate in the current session without re-login

eval "$(ssh-agent -s -t 4h)"

The next git command then prompts and caches for 4h. New logins do this automatically.

Useful commands

ssh-add -l        # list keys currently held by the agent
ssh-add -D        # forget all keys now (force re-prompt)
ssh-agent -k      # kill the current agent

Notes

• One agent per login connection. Several simultaneous SSH sessions each get their
  own agent (each prompts once). To share one cache across them, use tmux (panes
  inherit the first session's agent) or switch to a fixed-socket agent setup.

[ulises-c]

Why the manual dance is needed every time

The command eval "$(ssh-agent -s)" && ssh-add ~/.ssh/<key> && git fetch && git pull re-bootstraps an empty state on every shell:

• eval "$(ssh-agent -s)" starts a brand-new ssh-agent for this shell only. When the terminal closes, that agent dies — next terminal = no agent.
• ssh-add ~/.ssh/<key> loads the key into that throwaway agent. Since the agent is new every time, the key is never remembered.

The fix: one persistent agent + auto-load the key on first use.

1. One persistent agent (systemd user service)

Survives across all terminals and logins:

mkdir -p ~/.config/systemd/user
cat > ~/.config/systemd/user/ssh-agent.service <<'UNIT'
[Unit]
Description=SSH key agent

[Service]
Type=simple
Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK

[Install]
WantedBy=default.target
UNIT
systemctl --user enable --now ssh-agent.service

Point the shell at it once, in your ~/.zshrc:

export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket"

2. Auto-load the key on first git use

Add to your SSH config:

Host <key>-host          # match the host you push to
    IdentityFile ~/.ssh/<key>
    AddKeysToAgent yes

With AddKeysToAgent yes, the first git fetch of the day prompts for the passphrase once (if any), adds it to the persistent agent, and every session after that just works — committing/pulling becomes plain git fetch && git pull.

Time-gated variant (per this issue's title)

If the goal is to keep the key loaded only for a bounded window rather than indefinitely, use ssh-add -t <seconds> so the agent auto-expires it:

ssh-add -t 8h ~/.ssh/<key>   # key drops out of the agent after 8 hours

Combine with the persistent agent above and the key stays available for the work session, then expires automatically.