SSH agents are generally insecure by default and they don't present any useful information for auditing. Not only that but there's probably a half dozen differe

SSH agents are generally insecure by default and they don't present any useful information for auditing. Not only that but there's probably a half dozen different SSH agents installed and running on your Linux desktop right now. GNOME starts its own, GPG agent (oh god...) can act as one, openssh starts one, and if you try to disable one or any of them sometimes there's a fallback CLI agent that tries to start and run. All of them have insanely insecure defaults: aggressively cache every unlocked key and present every unlocked key to anyone who asks (which is anyone who can connect to the agent) without even so much as asking the user if some rogue process should be permitted to access the key. You can't uninstall the agents either. It's a non-optional part of each of those packages. You won't find all of them, anyone can start one, and any client will try to connect to it by default. If you mark it as non-executable then it will be re-marked as executable on the next package update. You can't put it as a symlink to /dev/null. Even truncating it and using SELinux to mark it as a file isn't guaranteed to keep the damn thing off after a system update. It's a f!@#$ing virus symptom. All because some users are too lazy to type their SSH passphrase more than once.