Which two statements about ssh-agent and ssh-add are correct? (Choose two.)
LPIC-1 Exam 102-500, objective 110. Security medium
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Choose 2.
Correct Running ssh-add with no arguments loads the default private keys found in ~/.ssh into the running agent, prompting once for each passphrase.
Correct. With no file arguments ssh-add tries the standard identity files such as ~/.ssh/id_rsa, ~/.ssh/id_ecdsa and ~/.ssh/id_ed25519.
Not correct The agent learns which keys it may use from the list in ~/.ssh/known_hosts.
Wrong. known_hosts is the client's record of the host keys of servers it has connected to. The agent's contents come solely from ssh-add.
Not correct ssh-add -l lists every private key on disk that the agent could load, whether or not it has been added.
Wrong. -l lists the fingerprints of the identities the agent is holding right now. A key sitting unloaded in ~/.ssh does not appear.
Correct The agent is normally started with `eval $(ssh-agent)` so that the SSH_AUTH_SOCK and SSH_AGENT_PID assignments it prints take effect in the current shell.
Correct. ssh-agent writes shell assignments to stdout; without eval they are merely printed, and ssh cannot find the agent because SSH_AUTH_SOCK is unset.
Not correct ssh-add strips the passphrase from the private key file on disk, so the key is stored unencrypted from then on.
Wrong. The file on disk is untouched. The decrypted key exists only in the agent's memory, which is why it disappears when the agent is killed. Changing a key's passphrase on disk is `ssh-keygen -p`.
Why
ssh-agent solves the problem that a passphrase-protected key would otherwise have to be typed on every connection. The agent holds the decrypted key in memory and answers challenges on the client's behalf; ssh finds it through the SSH_AUTH_SOCK environment variable. ssh-add -D drops all identities, and `ssh-add -t 3600 key` adds one with a lifetime. Agent forwarding (ssh -A) lets a remote session use your local agent, which is convenient but lets root on that remote host use your keys while you are connected.
Where this comes from
- Cited
- LPI exam objective 110.3
- What it says
- Use ssh-agent and ssh-add so a passphrase-protected key need be unlocked only once.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 110 and space the ones you get wrong.