I had this setup in Linux by using a script like [1] as SSH_ASKPASS and loading the keys into the agent with -c. I had it paired with an xscreensaver hook that

I had this setup in Linux by using a script like [1] as SSH_ASKPASS and loading the keys into the agent with -c. I had it paired with an xscreensaver hook that locked the agent when the screensaver was activated, bound the pause key to toggle locking and unlocking the agent (also with notifications), and a panel applet that indicated if the agent was locked. This made it so I could easily unlock the agent, and be notified of its use, on demand, then immediately lock it again. Some notes on this setup: 1) the ssh-agent protocol doesn't seem to define a way for the asking system to identify itself. This would be useful even if it was spoofable, since you can forward the agent through multiple systems. If the protocol supported identifying the host by signing something with a key that's only on that remote system (maybe the host key?), it might make knowing the identity of the asking system more robust/secure. It could also enable things like loading multiple keys into the agent and restricting which keys can be used for a given host. 2) You'd get roughly the same thing just by using -c with the default SSH_ASKPASS program, because it pops up a dialog. In that case it's only looking at the exit code of the ask-pass program, so it's not really useful for anything other than acknowledgement (you could modify it to do something with the entered password though), and so using notifications is better because they don't steal focus (and are thus easily missed/dismissed while typing -- this would be fixable if gnome hadn't removed a bunch of window manager window management customizations). 3) I had some mass ssh scripts that would continuously hit my agent, which filled the screen with notifications. I'm sure this is fixable with a more robust notification setup and better timeouts. 4) it would be cool to be able to "prime the pump" of the ssh-agent before it gets used, and it would only accept one request per hit of a key or only accept requests for some amount of time. For example, if I'm going to proxy an ssh connection through another host, I'd prime it with two requests before sshing. A panel applet that showed how many requests or time is left would be helpful here. 5) of course, all of this is dependent on the security of the machine your agent is running on, how much you feel like trusting the stuff that runs on that machine (like the X server), and the security of each machine that you're forwarding the agent to. ssh-agent is an oracle and will sign anything you give it and because of 1) above there's no way to tell who is asking. So keep those socket directories locked down and don't use a system where you don't/can't trust the admin. 6) I could only get this to work with openssh's ssh-agent, gnome-keyring's built in ssh-agent support doesn't seem to support the -c option on key addition (which I consider a serious regression for something that should have feature parity with what it is intended to replace). [1] https://gist.github.com/thwarted/ea392da4da0aaf8f9c19 https://gist.github.com/thwarted/ea392da4da0aaf8f9c19