SSH-AGENT-FILTER(1)

📦
version 0.5.3 · 6 versions
, in ubuntu stonking

💅 SSH-AGENT-FILTER — bestie's guide to the manual page 💅

okay so this is ssh-agent-filter(1), a User Commands page, and it's genuinely one of the most slay little security tools out there. sit down, grab a strawberry 🍓, and let me tell you about the filter that keeps your keys out of the wrong hands.

✨ NAME ✨

ssh-agent-filter — a filtering proxy for ssh-agent, meant to be forwarded to untrusted servers 🦋

no cap, that's the whole point. you hand a server a filtered view of your agent instead of the real thing. iconic behaviour honestly.

🌸 SYNOPSIS 🌸

ssh-agent-filter [ OPTIONS ]

that's it. that's the whole command. it takes options and vibes.

💖 DESCRIPTION 💖

so ssh-agent-filter serves up the unix domain socket interface of an ssh-agent. like, the same interface — nobody on the other end can tell the difference. by default it forks and outputs shell code setting SSH_AUTH_SOCK and SSH_AGENT_PID, exactly like ssh-agent does. same energy, different girl. ✨

it filters each request according to its command line options. so whatever you allow is what gets through — everything else? not invited to the party. 💅

here's the important bit, and I need you to actually read this one: no crypto operations are done by ssh-agent-filter. none. zero. it doesn't touch your keys like that. all of that gets delegated to the upstream ssh-agent. this girl is a bouncer, not a locksmith. 🎀

also: ssh-agent-filter is not meant to be used directly, but through afssh. so like, don't text it directly, go through its friend.

👑 OPTIONS 👑

every single one, bestie. no skipping.

  • -A, --all-confirmed — allow all other keys, but with confirmation. so it's a yes, just a yes-with-a-question-first. 🙈
  • -c, --comment arg — the key is specified by its comment.
  • -C, --comment-confirmed arg — the key is specified by its comment, with confirmation.
  • -d, --debug — show some debug info, and don't fork. (forking is cancelled, we're staying right here.)
  • -f, --fingerprint arg — the key is specified by the pubkey's hex-encoded md5 fingerprint.
  • -F, --fingerprint-confirmed arg — the key is specified by the pubkey's hex-encoded md5 fingerprint, with confirmation.
  • -h, --help — print this help message. the classic. 🫶
  • -k, --key arg — the key is specified by the base64-encoded pubkey.
  • -K, --key-confirmed arg — the key is specified by the base64-encoded pubkey, with confirmation.
  • -n, --name arg — a name for this instance of ssh-agent-filter, for confirmation purposes. give her a name, she deserves one. 🌸
  • -V, --version — print version information.
notice a pattern? every "specify a key" option has a capital-letter twin that adds with confirmation. lowercase = just let it through. uppercase = ask me first. that's the entire personality of this tool and I'm obsessed. 💖

🌈 ENVIRONMENT 🌈

  • SSH_AUTH_SOCK — socket of the upstream ssh-agent. (your real agent, the one doing the actual work.)
  • SSH_ASKPASS — command to run for confirmation questions. this is who gets asked when a -confirmed option needs a yes. ✨

⭐ AUTHOR ⭐

written by Timo Weingärtner. king behaviour, fr fr. 👑

🎀 REPORTING BUGS 🎀

found a bug? report it to the Debian BTS at https://bugs.debian.org/ or by mail to timo@tiwe.de. be nice about it, bugs are just features that didn't get enough sleep. 💀

🦋 SEE ALSO 🦋

and that's the whole page, bestie. this was ssh-agent-filter, version 0.5.3, dated March 2026 — go forth and filter responsibly. mwah 💅💖✨

📦 where this page comes from