Search code examples
linuxshellexecevalssh-agent

Alternatives to eval `ssh-agent` and exec ssh-agent bash

Running either of these commands seems to start an SSH agent process successfully:

eval `ssh-agent`

OR

exec ssh-agent bash

I'm partial to the first one, because the second exec replaces the shell. Obviously the second, uses eval which is frowned upon by some, but I don't see alternatives.

My questions are:

  1. Does exec have any negative side effects when replacing the shell or indeed any side effects at all? Are my concerns about using exec warranted?
  2. I don't have an issue using eval but, out of interest what alternative commands are there without scripts or functions (and without exec or eval) to start an ssh-agent process in one line?
Solution

  • This is a "safe" use of eval, at least to the extent that you trust ssh-agent to output nothing but simple, hard-coded assignments similar to

    SSH_AUTH_SOCK=/var/folders/...; export SSH_AUTH_SOCK;
SSH_AGENT_PID=xxxxx; export SSH_AGENT_PID;
echo Agent pid xxxxx;

    The output of ssh-agent is specifically designed to be passed to eval, and let's face it: if ssh-agent wanted to do harm, it could do so in a quieter fashion.

    The downside to using exec is that the new shell that replaces the original shell may not be identical; the environment is inherited, but some shell settings not found in .bashrc may be different. However, if you put exec ssh-agent bash in your .bashrc (especially as the last line), there there isn't really any opportunity for your shell's configuration to diverge from whatever .bashrc did. (There is also the possibility that you have non-idempotent code in your .bashrc, meaning that executing it twice will result in different behavior than having only executed it once. But again, that's unlikely and easily auditable.)