Bug#203942: More flexible ssh-agent invocation

[ucko@debian.org (Aaron M. Ucko)]

Francois Gouget <fgouget@free.fr> writes:

>    'ssh-agent -s' outputs a mini-script that sets the SSH_XXX variables.

I would generally recommend against running it this way; the ssh-agent
process can easily end up outliving your session, which is not
necessarily ideal as far as security goes.  (Yes, other users still
can't talk to it unless they manage to gain access to your account
anyway, but it's probably still best for anything that has your keys
to terminate promptly.)

In particular, note that the system-wide Xsession code ends up
exec-ing REALSTARTUP, which is by no means guaranteed to kill
$SSH_AGENT_PID when done, so most sessions probably will end up
leaving ssh-agent processes behind.

-- 
Aaron M. Ucko, KB1CJC (amu at alum.mit.edu, ucko at debian.org)
Finger amu@monk.mit.edu (NOT a valid e-mail address) for more info.