1.\" $OpenBSD: ssh-add.1,v 1.59 2013/12/07 11:58:46 naddy Exp $ 2.\" $FreeBSD$ 3.\" 4.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 5.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 6.\" All rights reserved 7.\" 8.\" As far as I am concerned, the code I have written for this software 9.\" can be used freely for any purpose. Any derived versions of this 10.\" software must be clearly marked as such, and if the derived work is 11.\" incompatible with the protocol description in the RFC file, it must be 12.\" called by a name other than "ssh" or "Secure Shell". 13.\" 14.\" 15.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 16.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 17.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 18.\" 19.\" Redistribution and use in source and binary forms, with or without 20.\" modification, are permitted provided that the following conditions 21.\" are met: 22.\" 1. Redistributions of source code must retain the above copyright 23.\" notice, this list of conditions and the following disclaimer. 24.\" 2. Redistributions in binary form must reproduce the above copyright 25.\" notice, this list of conditions and the following disclaimer in the 26.\" documentation and/or other materials provided with the distribution. 27.\" 28.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 29.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 30.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 31.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 32.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 33.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 34.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 35.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 36.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 37.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 38.\" 39.Dd December 7, 2013 40.Dt SSH-ADD 1 41.Os 42.Sh NAME 43.Nm ssh-add 44.Nd adds private key identities to the authentication agent 45.Sh SYNOPSIS 46.Nm ssh-add 47.Op Fl cDdkLlXx 48.Op Fl t Ar life 49.Op Ar 50.Nm ssh-add 51.Fl s Ar pkcs11 52.Nm ssh-add 53.Fl e Ar pkcs11 54.Sh DESCRIPTION 55.Nm 56adds private key identities to the authentication agent, 57.Xr ssh-agent 1 . 58When run without arguments, it adds the files 59.Pa ~/.ssh/id_rsa , 60.Pa ~/.ssh/id_dsa , 61.Pa ~/.ssh/id_ecdsa , 62.Pa ~/.ssh/id_ed25519 63and 64.Pa ~/.ssh/identity . 65After loading a private key, 66.Nm 67will try to load corresponding certificate information from the 68filename obtained by appending 69.Pa -cert.pub 70to the name of the private key file. 71Alternative file names can be given on the command line. 72.Pp 73If any file requires a passphrase, 74.Nm 75asks for the passphrase from the user. 76The passphrase is read from the user's tty. 77.Nm 78retries the last passphrase if multiple identity files are given. 79.Pp 80The authentication agent must be running and the 81.Ev SSH_AUTH_SOCK 82environment variable must contain the name of its socket for 83.Nm 84to work. 85.Pp 86The options are as follows: 87.Bl -tag -width Ds 88.It Fl c 89Indicates that added identities should be subject to confirmation before 90being used for authentication. 91Confirmation is performed by the 92.Ev SSH_ASKPASS 93program mentioned below. 94Successful confirmation is signaled by a zero exit status from the 95.Ev SSH_ASKPASS 96program, rather than text entered into the requester. 97.It Fl D 98Deletes all identities from the agent. 99.It Fl d 100Instead of adding identities, removes identities from the agent. 101If 102.Nm 103has been run without arguments, the keys for the default identities and 104their corresponding certificates will be removed. 105Otherwise, the argument list will be interpreted as a list of paths to 106public key files to specify keys and certificates to be removed from the agent. 107If no public key is found at a given path, 108.Nm 109will append 110.Pa .pub 111and retry. 112.It Fl e Ar pkcs11 113Remove keys provided by the PKCS#11 shared library 114.Ar pkcs11 . 115.It Fl k 116When loading keys into or deleting keys from the agent, process plain private 117keys only and skip certificates. 118.It Fl L 119Lists public key parameters of all identities currently represented 120by the agent. 121.It Fl l 122Lists fingerprints of all identities currently represented by the agent. 123.It Fl s Ar pkcs11 124Add keys provided by the PKCS#11 shared library 125.Ar pkcs11 . 126.It Fl t Ar life 127Set a maximum lifetime when adding identities to an agent. 128The lifetime may be specified in seconds or in a time format 129specified in 130.Xr sshd_config 5 . 131.It Fl X 132Unlock the agent. 133.It Fl x 134Lock the agent with a password. 135.El 136.Sh ENVIRONMENT 137.Bl -tag -width Ds 138.It Ev "DISPLAY" and "SSH_ASKPASS" 139If 140.Nm 141needs a passphrase, it will read the passphrase from the current 142terminal if it was run from a terminal. 143If 144.Nm 145does not have a terminal associated with it but 146.Ev DISPLAY 147and 148.Ev SSH_ASKPASS 149are set, it will execute the program specified by 150.Ev SSH_ASKPASS 151and open an X11 window to read the passphrase. 152This is particularly useful when calling 153.Nm 154from a 155.Pa .xsession 156or related script. 157(Note that on some machines it 158may be necessary to redirect the input from 159.Pa /dev/null 160to make this work.) 161.It Ev SSH_AUTH_SOCK 162Identifies the path of a 163.Ux Ns -domain 164socket used to communicate with the agent. 165.El 166.Sh FILES 167.Bl -tag -width Ds 168.It Pa ~/.ssh/identity 169Contains the protocol version 1 RSA authentication identity of the user. 170.It Pa ~/.ssh/id_dsa 171Contains the protocol version 2 DSA authentication identity of the user. 172.It Pa ~/.ssh/id_ecdsa 173Contains the protocol version 2 ECDSA authentication identity of the user. 174.It Pa ~/.ssh/id_ed25519 175Contains the protocol version 2 ED25519 authentication identity of the user. 176.It Pa ~/.ssh/id_rsa 177Contains the protocol version 2 RSA authentication identity of the user. 178.El 179.Pp 180Identity files should not be readable by anyone but the user. 181Note that 182.Nm 183ignores identity files if they are accessible by others. 184.Sh EXIT STATUS 185Exit status is 0 on success, 1 if the specified command fails, 186and 2 if 187.Nm 188is unable to contact the authentication agent. 189.Sh SEE ALSO 190.Xr ssh 1 , 191.Xr ssh-agent 1 , 192.Xr ssh-keygen 1 , 193.Xr sshd 8 194.Sh AUTHORS 195OpenSSH is a derivative of the original and free 196ssh 1.2.12 release by Tatu Ylonen. 197Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 198Theo de Raadt and Dug Song 199removed many bugs, re-added newer features and 200created OpenSSH. 201Markus Friedl contributed the support for SSH 202protocol versions 1.5 and 2.0. 203