Which two statements about ssh-agent and ssh-add are correct? (Choose two.)
LPIC-1 Exam 102-500, objective 110. Security medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Choose 2.
Correct Running ssh-add with no arguments loads the default private keys found in ~/.ssh into the running agent, prompting once for each passphrase.
Correct. With no file arguments ssh-add tries the standard identity files such as ~/.ssh/id_rsa, ~/.ssh/id_ecdsa and ~/.ssh/id_ed25519.
Not correct The agent learns which keys it may use from the list in ~/.ssh/known_hosts.
Wrong. known_hosts is the client's record of the host keys of servers it has connected to. The agent's contents come solely from ssh-add.
Not correct ssh-add -l lists every private key on disk that the agent could load, whether or not it has been added.
Wrong. -l lists the fingerprints of the identities the agent is holding right now. A key sitting unloaded in ~/.ssh does not appear.
Correct The agent is normally started with `eval $(ssh-agent)` so that the SSH_AUTH_SOCK and SSH_AGENT_PID assignments it prints take effect in the current shell.
Correct. ssh-agent writes shell assignments to stdout; without eval they are merely printed, and ssh cannot find the agent because SSH_AUTH_SOCK is unset.
Not correct ssh-add strips the passphrase from the private key file on disk, so the key is stored unencrypted from then on.
Wrong. The file on disk is untouched. The decrypted key exists only in the agent's memory, which is why it disappears when the agent is killed. Changing a key's passphrase on disk is `ssh-keygen -p`.
Why
ssh-agent solves the problem that a passphrase-protected key would otherwise have to be typed on every connection. The agent holds the decrypted key in memory and answers challenges on the client's behalf; ssh finds it through the SSH_AUTH_SOCK environment variable. ssh-add -D drops all identities, and `ssh-add -t 3600 key` adds one with a lifetime. Agent forwarding (ssh -A) lets a remote session use your local agent, which is convenient but lets root on that remote host use your keys while you are connected.
Where this comes from
- Cited
- LPI exam objective 110.3
- What it says
- Use ssh-agent and ssh-add so a passphrase-protected key need be unlocked only once.
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 110 and space the ones you get wrong.
More questions on this objective
- During an audit you must list every file under /usr that has the set-user-ID bit set, regardless of what its other permission bits are. Which command does that? machine-checked
- You locked the password of the account `intern` and confirmed that its hash in /etc/shadow now begins with an exclamation mark. The intern nevertheless still reaches a shell on the host over SSH, without being prompted for anything. What is going on, and what actually stops it? machine-checked
- You have just been added to a sudo rule on a host and want sudo itself to report which commands you are allowed to run there, without running any of them. Type the complete command. machine-checked
- A daemon started from your bash session keeps hitting a 'too many open files' error. Which command raises the limit on open file descriptors for the current shell and the processes it starts to 4096? machine-checked
- You are about to take a server down for maintenance and want ordinary users refused at login for the next hour, with an explanatory message, while root can still get in. On a system using PAM's pam_nologin, creating which file achieves this? machine-checked
- Which two commands report the users who are logged in right now, rather than a history of past logins? (Choose two.) machine-checked