PAM_SSH_ADD(8)

✨ PAM_SSH_ADD(8) — aka pam_ssh_add ✨

okay bestie, gather round, we're talking about a little PAM module from the cockpit universe (section 8 of the manual, sysadmin territory, very demure, very mindful). 💅

---

🌸 NAME 🌸

pam_ssh_add — a PAM module that auto loads ssh keys into an agent. literally does your ssh-agent admin for you so you don't have to. 🗝️✨

---

🦋 SYNOPSIS 🦋

the vibe is: it's a PAM module, you drop it in your pam config, it does the thing. there's no command line to type, no flags to pass at the shell — it's PAM's problem now. 🫶

---

💖 DESCRIPTION 💖

so like. pam_ssh_add hands you authentication and session modules, and the whole point is that users get to start their session with a running ssh-agent that has as many ssh keys loaded as possible. that's it, that's the dream. 🌈

If you use it, the authentication module basically just... stores the authentication token for later, so the session module can use it. that's it. that's all it does. it's a keeper of secrets, a little token squirrel. 🐿️

🚨 important!! Because this module performs no actual authentication, it returns PAM_CRED_INSUFFICIENT on success. yes you read that right, on success. it is NOT an auth module in the "I will protect you" sense, so it should always be accompanied by an actual authentication module in your pam configuration. do not let it carry the team alone bestie, it will not. 💀

By default, the session module will start a new ssh-agent and run ssh-add, loading any keys that exist in the default path for the newly logged in user. lowkey iconic behaviour. 🎀

And if any of those keys prompt for a password — and an authentication token was successfully stored earlier — then that token will be provided as the password. chef's kiss, no typing, ate. 👑

---

💅 OPTIONS 💅

• debug — this option turns on debug logging to syslog. use it when you're in your detective era. 🕵️♀️✨

---

🌟 EXAMPLES 🌟

here's the whole vibe in pam config form, copy it exactly bestie:

auth     required  pam_unix.so
auth     optional  pam_ssh_add.so
session  optional  pam_ssh_add.so

see how pam_unix.so is required and doing the actual authentication? yeah. that's the friendship dynamic. pam_ssh_add is the optional bestie holding the keys. 🤝

---

💀 BUGS 💀

found something cursed? Please send bug reports to either the distribution bug tracker or the upstream bug tracker at https://github.com/cockpit-project/cockpit/issues/new. they want to hear from you fr fr. 🙈

---

👑 AUTHOR 👑

Cockpit has been written by many contributors — https://github.com/cockpit-project/cockpit. a whole group chat of legends. 💜

---

🫶 SEE ALSO 🫶

(ngl bestie, the original page didn't list any SEE ALSO refs, so go touch some grass or read another manpage, iykyk) 🌸

---

and that's a wrap! this page came from cockpit, dated 2026-10-22, and it's giving PAM_SSH_ADD(8) main character energy from start to finish. slay, go load those keys. 🎀✨💖