SSH & Remote Administration

Force your SSH agent to actually use your YubiKey

🧩 The Challenge

You finally set up FIDO2 security keys for your SSH keys, but every time you open a new window, the agent asks you to touch the physical button again. It turns into a total nightmare when you’re running ansible playbooks or quick scripts that need to jump across five servers.

💡 The Fix

Tell your SSH agent to store that key with a confirm-constraint, but configure the lifetime so you aren’t forced to tap the hardware for every single handshake. It keeps the security benefit without the manual labor during a long session.

ssh-add -t 1h -c ~/.ssh/id_ed25519_sk

⚙️ Why It Works

Setting the timeout flag ensures the key gets dropped from memory after an hour, while the confirm flag keeps the security high even if someone manages to compromise your active shell. You’re basically telling the agent to trust the key temporarily, provided you’ve already satisfied the physical touch requirement.

🚀 Pro-Tip: Use the -l flag afterwards to verify the timeout actually stuck, or you’ll be hitting your key again in five minutes.

Linux Tips & Tricks | © ngelinux.com | 11/1/2026