Using SSH Agent with KDE Plasma

A user-level ssh-agent service can start with the Plasma session, but that does not automatically load private keys. This setup starts the agent before Plasma, makes graphical passphrase prompts available, and uses an XDG autostart entry to add selected keys after login.

Start ssh-agent with systemd

Create ~/.config/systemd/user/ssh-agent.service:

[Unit]
Description=SSH key agent
Wants=gpg-agent-ssh.socket
After=gpg-agent-ssh.socket
Before=plasma-plasmashell.service

[Service]
Type=forking
Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
Environment=SSH_ASKPASS_REQUIRE=prefer
Environment=SSH_ASKPASS=/usr/bin/ksshaskpass
ExecStartPre=/bin/sh -c 'if [ -e "$SSH_AUTH_SOCK" ]; then rm -f "$SSH_AUTH_SOCK"; fi'
ExecStart=/usr/bin/ssh-agent -a $SSH_AUTH_SOCK
ExecStartPost=/usr/bin/systemctl --user set-environment SSH_AUTH_SOCK=%t/ssh-agent.socket
ExecStop=/bin/sh -c "SSH_AGENT_PID=$MAINPID /usr/bin/ssh-agent -k; if [ -e "$SSH_AUTH_SOCK" ]; then rm -f $SSH_AUTH_SOCK; fi"

[Install]
WantedBy=default.target

The runtime socket lives under $XDG_RUNTIME_DIR; %t is systemd’s alias for that directory. ExecStartPost publishes the socket path to the user systemd manager for units started later. The Before dependency makes the agent start before the Plasma shell.

Enable the service:

systemctl --user daemon-reload
systemctl --user enable --now ssh-agent.service
systemctl --user status ssh-agent.service

Configure graphical passphrase prompts

Install ksshaskpass, then create ~/.config/plasma-workspace/env/00-ssh-askpass.sh:

#!/bin/sh
case "${XDG_SESSION_TYPE:-}" in
    x11|wayland)
        export SSH_ASKPASS_REQUIRE=force
        ;;
esac

Plasma sources scripts in this directory when starting the graphical session. The key-loading script below also sets SSH_ASKPASS explicitly so ssh-add uses ksshaskpass even when its environment comes from the desktop autostart process.

Add keys after Plasma login

Create ~/.config/autostart/ssh-add-all-keys.sh:

#!/bin/sh
set -u

: "${XDG_RUNTIME_DIR:?XDG_RUNTIME_DIR is not set}"
export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket"
export SSH_ASKPASS=/usr/bin/ksshaskpass
export SSH_ASKPASS_REQUIRE=force

exec /usr/bin/ssh-add \
    "$HOME/.ssh/id_ed25519" \
    "$HOME/.ssh/id_ed25519_sk" \
    "$HOME/.ssh/id_rsa"

This list is machine-specific; remove any identities that should not be loaded. ssh-add asks for a key passphrase through ksshaskpass when needed. A FIDO security key may also require physical confirmation.

Create ~/.config/autostart/ssh-add-all-keys.desktop:

[Desktop Entry]
Type=Application
Name=Add SSH keys to agent
Comment=Load SSH identities into the Plasma session agent
Exec=/bin/sh -c "exec \"$HOME/.config/autostart/ssh-add-all-keys.sh\""
TryExec=/bin/sh
Terminal=false
NoDisplay=true
StartupNotify=false

The shell expands $HOME, so this entry works without hard-coding a username; ~ itself is not expanded in a desktop entry’s Exec command. The script sets SSH_AUTH_SOCK to the same socket configured in the systemd unit.

Add keys on first use

AddKeysToAgent yes in ~/.ssh/config adds a key to the agent when it is first used. This is useful for keys not loaded at login, but it does not preload keys when Plasma starts:

Host *
    AddKeysToAgent yes

Check loaded identities with:

ssh-add -l

Use a key directly from a terminal

For a FIDO key that should prompt in the terminal instead of using the agent, disable the agent for that command:

ssh-tty() {
    SSH_AUTH_SOCK= SSH_ASKPASS_REQUIRE=never command ssh \
        -o IdentityAgent=none \
        -o IdentitiesOnly=yes \
        -i "$HOME/.ssh/id_ed25519_sk" \
        "$@"
}

Security note

Only load identities needed for the session. If ForwardAgent yes is enabled, remote hosts can use the forwarded agent to authenticate as any loaded identity while the connection is active. Agent forwarding does not copy private-key files, but a compromised remote host can still request signatures from the agent.