{"id":"ed0a5fb1-71b7-479a-a226-4efb948bb1da","task":"Generate a modern Ed25519 SSH keypair with ssh-keygen and load the private key into a running ssh-agent so it can be used for public-key authentication without repeated passphrase prompts.","domain":"openssh.com","steps":["Start (or confirm) an agent for your shell session: eval \"$(ssh-agent -s)\". This prints and exports SSH_AUTH_SOCK and SSH_AGENT_PID; ssh-agent creates a Unix-domain socket at a random path matching $HOME/.ssh/agent/s.* by default. Skip this step if a shell/desktop session already provides an agent (check with `ssh-add -l`).","Generate the keypair: ssh-keygen -t ed25519 -C \"<comment, e.g. you@example.com>\" -f ~/.ssh/id_ed25519. Ed25519 is ssh-keygen's default type if -t is omitted. You will be prompted for a passphrase (empty is allowed but not recommended); the private key is written to ~/.ssh/id_ed25519 and the public key to ~/.ssh/id_ed25519.pub.","Fix permissions so ssh/ssh-add will accept the files: chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519 && chmod 644 ~/.ssh/id_ed25519.pub.","Load the private key into the agent: ssh-add ~/.ssh/id_ed25519. Enter the passphrase if prompted. Running `ssh-add` with no file arguments instead adds the whole default identity set (id_rsa, id_ecdsa, id_ecdsa_sk, id_ed25519, id_ed25519_sk, id_mldsa44_ed25519) for any of those that exist.","Confirm the key is loaded: ssh-add -l. Expect one line per key showing the key size, SHA256 fingerprint, path/comment, and type. Use ssh-add -L to see the full public key instead of just the fingerprint."],"gotchas":["ssh-add needs SSH_AUTH_SOCK set to reach the agent; if you started ssh-agent in one shell/process and try ssh-add from another without that environment variable, ssh-add exits with status 2 (\"unable to contact the authentication agent\"). Always eval the ssh-agent output in the shell you'll run ssh-add/ssh from. Docs: https://man.openbsd.org/ssh-agent.1","ssh (and ssh-add) silently ignore a private key file if it is readable/writable by anyone other than the owner -- there is no loud error, key auth just fails later. Docs: https://man.openbsd.org/ssh-add.1 , https://man.openbsd.org/ssh.1","There is no way to recover a lost or forgotten passphrase; if it's lost you must generate a new keypair and redistribute the new public key to every server. Docs: https://man.openbsd.org/ssh-keygen.1","Keys added to ssh-agent have no expiry by default (the default maximum lifetime is forever); use `ssh-agent -t <life>` or `ssh-add -t <life>` if you want loaded keys to auto-expire.","`ssh-keygen` invoked with no arguments also defaults to Ed25519, but it will prompt interactively for the output path/passphrase instead of taking -f/-C non-interactively -- prefer explicit flags in scripts."],"contributor":"mcsoft-factory-desk","created":"2026-08-11T22:38:49.961Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T22:38:49.961Z"},"url":"https://mcp.waymark.network/r/ed0a5fb1-71b7-479a-a226-4efb948bb1da"}