{
    "content": [
        {
            "type": "text",
            "text": "# SSH-ADD (man)\n\n## NAME\n\nssh-add — adds private key identities to the OpenSSH authentication agent\n\n## SYNOPSIS\n\nssh-add  [-cCDdKkLlqvXx]  [-E fingerprinthash] [-H hostkeyfile] [-h destinationconstraint]\n[-S provider] [-t life] [file ...]\nssh-add -s pkcs11 [-vC] [certificate ...]\nssh-add -e pkcs11\nssh-add -T pubkey ...\n\n## DESCRIPTION\n\nssh-add adds private key identities to the  authentication  agent,  ssh-agent(1).   When  run\nwithout  arguments,  it  adds  the  files ~/.ssh/idrsa, ~/.ssh/idecdsa, ~/.ssh/idecdsask,\n~/.ssh/ided25519, ~/.ssh/ided25519sk, and ~/.ssh/iddsa.  After  loading  a  private  key,\nssh-add  will try to load corresponding certificate information from the filename obtained by\nappending -cert.pub to the name of the private key file.  Alternative file names can be given\non the command line.\n\n## TLDR\n\n> Manage loaded SSH keys in the `ssh-agent`.\n\n- Add the default SSH keys in `~/.ssh` to the ssh-agent:\n  `ssh-add`\n- Add a specific key to the `ssh-agent`:\n  `ssh-add {{path/to/private_key}}`\n- List fingerprints of currently loaded keys:\n  `ssh-add -l`\n- Delete a key from the `ssh-agent`:\n  `ssh-add -d {{path/to/private_key}}`\n- Delete all currently loaded keys from the `ssh-agent`:\n  `ssh-add -D`\n- Add a key to the `ssh-agent` and the keychain:\n  `ssh-add -K {{path/to/private_key}}`\n\n*Source: tldr-pages*\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION** (20 subsections)\n- **ENVIRONMENT**\n- **FILES**\n- **EXIT STATUS**\n- **SEE ALSO**\n- **AUTHORS**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n"
        }
    ],
    "structuredContent": {
        "command": "SSH-ADD",
        "section": "",
        "mode": "man",
        "summary": "ssh-add — adds private key identities to the OpenSSH authentication agent",
        "synopsis": "ssh-add  [-cCDdKkLlqvXx]  [-E fingerprinthash] [-H hostkeyfile] [-h destinationconstraint]\n[-S provider] [-t life] [file ...]\nssh-add -s pkcs11 [-vC] [certificate ...]\nssh-add -e pkcs11\nssh-add -T pubkey ...",
        "tldr_summary": "Manage loaded SSH keys in the `ssh-agent`.",
        "tldr_examples": [
            {
                "description": "Add the default SSH keys in `~/.ssh` to the ssh-agent",
                "command": "ssh-add"
            },
            {
                "description": "Add a specific key to the `ssh-agent`",
                "command": "ssh-add {{path/to/private_key}}"
            },
            {
                "description": "List fingerprints of currently loaded keys",
                "command": "ssh-add -l"
            },
            {
                "description": "Delete a key from the `ssh-agent`",
                "command": "ssh-add -d {{path/to/private_key}}"
            },
            {
                "description": "Delete all currently loaded keys from the `ssh-agent`",
                "command": "ssh-add -D"
            },
            {
                "description": "Add a key to the `ssh-agent` and the keychain",
                "command": "ssh-add -K {{path/to/private_key}}"
            }
        ],
        "tldr_source": "official",
        "flags": [
            {
                "flag": "-c",
                "long": null,
                "arg": null,
                "description": "for authentication. Confirmation is performed by ssh-askpass(1). Successful confir‐ mation is signaled by a zero exit status from ssh-askpass(1), rather than text en‐ tered into the requester."
            },
            {
                "flag": "-C",
                "long": null,
                "arg": null,
                "description": "skip plain keys."
            },
            {
                "flag": "-D",
                "long": null,
                "arg": null,
                "description": ""
            },
            {
                "flag": "-d",
                "long": null,
                "arg": null,
                "description": "run without arguments, the keys for the default identities and their corresponding certificates will be removed. Otherwise, the argument list will be interpreted as a list of paths to public key files to specify keys and certificates to be removed from the agent. If no public key is found at a given path, ssh-add will append .pub and retry. If the argument list consists of “-” then ssh-add will read public keys to be removed from standard input."
            },
            {
                "flag": "-E",
                "long": null,
                "arg": null,
                "description": "Specifies the hash algorithm used when displaying key fingerprints. Valid options are: “md5” and “sha256”. The default is “sha256”."
            },
            {
                "flag": "-e",
                "long": null,
                "arg": null,
                "description": "Remove keys provided by the PKCS#11 shared library pkcs11."
            },
            {
                "flag": "-H",
                "long": null,
                "arg": null,
                "description": "Specifies a known hosts file to look up hostkeys when using destination-constrained keys via the -h flag. This option may be specified multiple times to allow multiple files to be searched. If no files are specified, ssh-add will use the default sshconfig(5) known hosts files: ~/.ssh/knownhosts, ~/.ssh/knownhosts2, /etc/ssh/sshknownhosts, and /etc/ssh/sshknownhosts2."
            },
            {
                "flag": "-h",
                "long": null,
                "arg": null,
                "description": "When adding keys, constrain them to be usable only through specific hosts or to spe‐ cific destinations. Destination constraints of the form ‘[user@]dest-hostname’ permit use of the key only from the origin host (the one running ssh-agent(1)) to the listed destination host, with optional user name. Constraints of the form ‘src-hostname>[user@]dst-hostname’ allow a key available on a forwarded ssh-agent(1) to be used through a particular host (as specified by ‘src-hostname’) to authenticate to a further host, specified by ‘dst-hostname’. Multiple destination constraints may be added when loading keys. When attempting au‐ thentication with a key that has destination constraints, the whole connection path, including ssh-agent(1) forwarding, is tested against those constraints and each hop must be permitted for the attempt to succeed. For example, if key is forwarded to a remote host, ‘host-b’, and is attempting authentication to another host, ‘host-c’, then the operation will be successful only if ‘host-b’ was permitted from the origin host and the subsequent ‘host-b>host-c’ hop is also permitted by destination con‐ straints. Hosts are identified by their host keys, and are looked up from known hosts files by ssh-add. Wildcards patterns may be used for hostnames and certificate host keys are supported. By default, keys added by ssh-add are not destination constrained. Destination constraints were added in OpenSSH release 8.9. Support in both the re‐ mote SSH client and server is required when using destination-constrained keys over a forwarded ssh-agent(1) channel. It is also important to note that destination constraints can only be enforced by ssh-agent(1) when a key is used, or when it is forwarded by a cooperating ssh(1). Specifically, it does not prevent an attacker with access to a remote SSHAUTHSOCK from forwarding it again and using it on a different host (but only to a permitted destination)."
            },
            {
                "flag": "-K",
                "long": null,
                "arg": null,
                "description": ""
            },
            {
                "flag": "-k",
                "long": null,
                "arg": null,
                "description": "only and skip certificates."
            },
            {
                "flag": "-L",
                "long": null,
                "arg": null,
                "description": ""
            },
            {
                "flag": "-l",
                "long": null,
                "arg": null,
                "description": ""
            },
            {
                "flag": "-q",
                "long": null,
                "arg": null,
                "description": ""
            },
            {
                "flag": "-S",
                "long": null,
                "arg": null,
                "description": "Specifies a path to a library that will be used when adding FIDO authenticator-hosted keys, overriding the default of using the internal USB HID support."
            },
            {
                "flag": "-s",
                "long": null,
                "arg": null,
                "description": "Add keys provided by the PKCS#11 shared library pkcs11. Certificate files may op‐ tionally be listed as command-line arguments. If these are present, then they will be loaded into the agent using any corresponding private keys loaded from the PKCS#11 token."
            },
            {
                "flag": "-T",
                "long": null,
                "arg": null,
                "description": "Tests whether the private keys that correspond to the specified pubkey files are us‐ able by performing sign and verify operations on each."
            },
            {
                "flag": "-t",
                "long": null,
                "arg": null,
                "description": "Set a maximum lifetime when adding identities to an agent. The lifetime may be spec‐ ified in seconds or in a time format specified in sshdconfig(5)."
            },
            {
                "flag": "-v",
                "long": null,
                "arg": null,
                "description": "is helpful in debugging problems. Multiple -v options increase the verbosity. The maximum is 3."
            },
            {
                "flag": "-X",
                "long": null,
                "arg": null,
                "description": ""
            },
            {
                "flag": "-x",
                "long": null,
                "arg": null,
                "description": ""
            }
        ],
        "examples": [],
        "see_also": [
            {
                "name": "ssh",
                "section": "1",
                "url": "https://www.chedong.com/phpMan.php/man/ssh/1/json"
            },
            {
                "name": "ssh-agent",
                "section": "1",
                "url": "https://www.chedong.com/phpMan.php/man/ssh-agent/1/json"
            },
            {
                "name": "ssh-askpass",
                "section": "1",
                "url": "https://www.chedong.com/phpMan.php/man/ssh-askpass/1/json"
            },
            {
                "name": "ssh-keygen",
                "section": "1",
                "url": "https://www.chedong.com/phpMan.php/man/ssh-keygen/1/json"
            },
            {
                "name": "sshd",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/sshd/8/json"
            }
        ],
        "section_outline": [
            {
                "name": "NAME",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "SYNOPSIS",
                "lines": 6,
                "subsections": []
            },
            {
                "name": "DESCRIPTION",
                "lines": 16,
                "subsections": [
                    {
                        "name": "-c",
                        "lines": 4,
                        "flag": "-c"
                    },
                    {
                        "name": "-C",
                        "lines": 2,
                        "flag": "-C"
                    },
                    {
                        "name": "-D",
                        "lines": 1,
                        "flag": "-D"
                    },
                    {
                        "name": "-d",
                        "lines": 7,
                        "flag": "-d"
                    },
                    {
                        "name": "-E _",
                        "lines": 3,
                        "flag": "-E"
                    },
                    {
                        "name": "-e _",
                        "lines": 2,
                        "flag": "-e"
                    },
                    {
                        "name": "-H _",
                        "lines": 6,
                        "flag": "-H"
                    },
                    {
                        "name": "-h _",
                        "lines": 34,
                        "flag": "-h"
                    },
                    {
                        "name": "-K",
                        "lines": 1,
                        "flag": "-K"
                    },
                    {
                        "name": "-k",
                        "lines": 2,
                        "flag": "-k"
                    },
                    {
                        "name": "-L",
                        "lines": 1,
                        "flag": "-L"
                    },
                    {
                        "name": "-l",
                        "lines": 1,
                        "flag": "-l"
                    },
                    {
                        "name": "-q",
                        "lines": 1,
                        "flag": "-q"
                    },
                    {
                        "name": "-S _",
                        "lines": 3,
                        "flag": "-S"
                    },
                    {
                        "name": "-s _",
                        "lines": 5,
                        "flag": "-s"
                    },
                    {
                        "name": "-T _",
                        "lines": 3,
                        "flag": "-T"
                    },
                    {
                        "name": "-t _",
                        "lines": 3,
                        "flag": "-t"
                    },
                    {
                        "name": "-v",
                        "lines": 3,
                        "flag": "-v"
                    },
                    {
                        "name": "-X",
                        "lines": 1,
                        "flag": "-X"
                    },
                    {
                        "name": "-x",
                        "lines": 1,
                        "flag": "-x"
                    }
                ]
            },
            {
                "name": "ENVIRONMENT",
                "lines": 21,
                "subsections": []
            },
            {
                "name": "FILES",
                "lines": 12,
                "subsections": []
            },
            {
                "name": "EXIT STATUS",
                "lines": 3,
                "subsections": []
            },
            {
                "name": "SEE ALSO",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "AUTHORS",
                "lines": 6,
                "subsections": []
            }
        ],
        "sections": {
            "NAME": {
                "content": "ssh-add — adds private key identities to the OpenSSH authentication agent\n",
                "subsections": []
            },
            "SYNOPSIS": {
                "content": "ssh-add  [-cCDdKkLlqvXx]  [-E fingerprinthash] [-H hostkeyfile] [-h destinationconstraint]\n[-S provider] [-t life] [file ...]\nssh-add -s pkcs11 [-vC] [certificate ...]\nssh-add -e pkcs11\nssh-add -T pubkey ...\n",
                "subsections": []
            },
            "DESCRIPTION": {
                "content": "ssh-add adds private key identities to the  authentication  agent,  ssh-agent(1).   When  run\nwithout  arguments,  it  adds  the  files ~/.ssh/idrsa, ~/.ssh/idecdsa, ~/.ssh/idecdsask,\n~/.ssh/ided25519, ~/.ssh/ided25519sk, and ~/.ssh/iddsa.  After  loading  a  private  key,\nssh-add  will try to load corresponding certificate information from the filename obtained by\nappending -cert.pub to the name of the private key file.  Alternative file names can be given\non the command line.\n\nIf any file requires a passphrase, ssh-add asks  for  the  passphrase  from  the  user.   The\npassphrase  is  read  from  the  user's tty.  ssh-add retries the last passphrase if multiple\nidentity files are given.\n\nThe authentication agent must be running and the SSHAUTHSOCK environment variable must con‐\ntain the name of its socket for ssh-add to work.\n\nThe options are as follows:\n",
                "subsections": [
                    {
                        "name": "-c",
                        "content": "for authentication.  Confirmation is performed by ssh-askpass(1).  Successful confir‐\nmation  is  signaled  by a zero exit status from ssh-askpass(1), rather than text en‐\ntered into the requester.\n",
                        "flag": "-c"
                    },
                    {
                        "name": "-C",
                        "content": "skip plain keys.\n",
                        "flag": "-C"
                    },
                    {
                        "name": "-D",
                        "content": "",
                        "flag": "-D"
                    },
                    {
                        "name": "-d",
                        "content": "run without arguments, the keys for the default identities  and  their  corresponding\ncertificates  will be removed.  Otherwise, the argument list will be interpreted as a\nlist of paths to public key files to specify keys and certificates to be removed from\nthe agent.  If no public key is found at a given path, ssh-add will append  .pub  and\nretry.  If the argument list consists of “-” then ssh-add will read public keys to be\nremoved from standard input.\n",
                        "flag": "-d"
                    },
                    {
                        "name": "-E _",
                        "content": "Specifies  the  hash  algorithm used when displaying key fingerprints.  Valid options\nare: “md5” and “sha256”.  The default is “sha256”.\n",
                        "flag": "-E"
                    },
                    {
                        "name": "-e _",
                        "content": "Remove keys provided by the PKCS#11 shared library pkcs11.\n",
                        "flag": "-e"
                    },
                    {
                        "name": "-H _",
                        "content": "Specifies a known hosts file to look up hostkeys when  using  destination-constrained\nkeys  via the -h flag.  This option may be specified multiple times to allow multiple\nfiles to be searched.  If no files  are  specified,  ssh-add  will  use  the  default\nsshconfig(5)    known    hosts   files:   ~/.ssh/knownhosts,   ~/.ssh/knownhosts2,\n/etc/ssh/sshknownhosts, and /etc/ssh/sshknownhosts2.\n",
                        "flag": "-H"
                    },
                    {
                        "name": "-h _",
                        "content": "When adding keys, constrain them to be usable only through specific hosts or to  spe‐\ncific destinations.\n\nDestination constraints of the form ‘[user@]dest-hostname’ permit use of the key only\nfrom  the  origin host (the one running ssh-agent(1)) to the listed destination host,\nwith optional user name.\n\nConstraints of the form ‘src-hostname>[user@]dst-hostname’ allow a key available on a\nforwarded ssh-agent(1) to  be  used  through  a  particular  host  (as  specified  by\n‘src-hostname’) to authenticate to a further host, specified by ‘dst-hostname’.\n\nMultiple destination constraints may be added when loading keys.  When attempting au‐\nthentication  with a key that has destination constraints, the whole connection path,\nincluding ssh-agent(1) forwarding, is tested against those constraints and  each  hop\nmust  be permitted for the attempt to succeed.  For example, if key is forwarded to a\nremote host, ‘host-b’, and is attempting authentication to  another  host,  ‘host-c’,\nthen  the operation will be successful only if ‘host-b’ was permitted from the origin\nhost and the subsequent ‘host-b>host-c’ hop is also  permitted  by  destination  con‐\nstraints.\n\nHosts  are identified by their host keys, and are looked up from known hosts files by\nssh-add.  Wildcards patterns may be used for hostnames and certificate host keys  are\nsupported.  By default, keys added by ssh-add are not destination constrained.\n\nDestination  constraints  were added in OpenSSH release 8.9.  Support in both the re‐\nmote SSH client and server is required when using destination-constrained keys over a\nforwarded ssh-agent(1) channel.\n\nIt is also important to note that destination constraints can  only  be  enforced  by\nssh-agent(1)  when  a  key  is used, or when it is forwarded by a cooperating ssh(1).\nSpecifically, it does not prevent an attacker with access to a  remote  SSHAUTHSOCK\nfrom  forwarding  it  again and using it on a different host (but only to a permitted\ndestination).\n",
                        "flag": "-h"
                    },
                    {
                        "name": "-K",
                        "content": "",
                        "flag": "-K"
                    },
                    {
                        "name": "-k",
                        "content": "only and skip certificates.\n",
                        "flag": "-k"
                    },
                    {
                        "name": "-L",
                        "content": "",
                        "flag": "-L"
                    },
                    {
                        "name": "-l",
                        "content": "",
                        "flag": "-l"
                    },
                    {
                        "name": "-q",
                        "content": "",
                        "flag": "-q"
                    },
                    {
                        "name": "-S _",
                        "content": "Specifies a path to a library that will be used when adding FIDO authenticator-hosted\nkeys, overriding the default of using the internal USB HID support.\n",
                        "flag": "-S"
                    },
                    {
                        "name": "-s _",
                        "content": "Add  keys  provided  by the PKCS#11 shared library pkcs11.  Certificate files may op‐\ntionally be listed as command-line arguments.  If these are present, then  they  will\nbe loaded into the agent using any corresponding private keys loaded from the PKCS#11\ntoken.\n",
                        "flag": "-s"
                    },
                    {
                        "name": "-T _",
                        "content": "Tests  whether the private keys that correspond to the specified pubkey files are us‐\nable by performing sign and verify operations on each.\n",
                        "flag": "-T"
                    },
                    {
                        "name": "-t _",
                        "content": "Set a maximum lifetime when adding identities to an agent.  The lifetime may be spec‐\nified in seconds or in a time format specified in sshdconfig(5).\n",
                        "flag": "-t"
                    },
                    {
                        "name": "-v",
                        "content": "is  helpful  in debugging problems.  Multiple -v options increase the verbosity.  The\nmaximum is 3.\n",
                        "flag": "-v"
                    },
                    {
                        "name": "-X",
                        "content": "",
                        "flag": "-X"
                    },
                    {
                        "name": "-x",
                        "content": "",
                        "flag": "-x"
                    }
                ]
            },
            "ENVIRONMENT": {
                "content": "DISPLAY, SSHASKPASS and SSHASKPASSREQUIRE\nIf ssh-add needs a passphrase, it will read the passphrase from the current  terminal\nif  it  was run from a terminal.  If ssh-add does not have a terminal associated with\nit but DISPLAY and SSHASKPASS are set, it will  execute  the  program  specified  by\nSSHASKPASS (by default “ssh-askpass”) and open an X11 window to read the passphrase.\nThis is particularly useful when calling ssh-add from a .xsession or related script.\n\nSSHASKPASSREQUIRE  allows  further  control over the use of an askpass program.  If\nthis variable is set to “never” then ssh-add will never attempt to use one.  If it is\nset to “prefer”, then ssh-add will prefer to use the askpass program instead  of  the\nTTY  when requesting passwords.  Finally, if the variable is set to “force”, then the\naskpass program will be used for all passphrase input regardless of  whether  DISPLAY\nis set.\n\nSSHAUTHSOCK\nIdentifies the path of a Unix-domain socket used to communicate with the agent.\n\nSSHSKPROVIDER\nSpecifies  a path to a library that will be used when loading any FIDO authenticator-\nhosted keys, overriding the default of using the built-in USB HID support.\n",
                "subsections": []
            },
            "FILES": {
                "content": "~/.ssh/iddsa\n~/.ssh/idecdsa\n~/.ssh/idecdsask\n~/.ssh/ided25519\n~/.ssh/ided25519sk\n~/.ssh/idrsa\nContains the DSA, ECDSA, authenticator-hosted  ECDSA,  Ed25519,  authenticator-hosted\nEd25519 or RSA authentication identity of the user.\n\nIdentity  files  should  not  be  readable by anyone but the user.  Note that ssh-add ignores\nidentity files if they are accessible by others.\n",
                "subsections": []
            },
            "EXIT STATUS": {
                "content": "Exit status is 0 on success, 1 if the specified command fails, and 2 if ssh-add is unable  to\ncontact the authentication agent.\n",
                "subsections": []
            },
            "SEE ALSO": {
                "content": "ssh(1), ssh-agent(1), ssh-askpass(1), ssh-keygen(1), sshd(8)\n",
                "subsections": []
            },
            "AUTHORS": {
                "content": "OpenSSH  is  a  derivative of the original and free ssh 1.2.12 release by Tatu Ylonen.  Aaron\nCampbell, Bob Beck, Markus Friedl, Niels Provos, Theo de Raadt  and  Dug  Song  removed  many\nbugs, re-added newer features and created OpenSSH.  Markus Friedl contributed the support for\nSSH protocol versions 1.5 and 2.0.\n\nDebian                                    December 18, 2023                               SSH-ADD(1)",
                "subsections": []
            }
        }
    }
}