For travel, load SSH keys into the agent with a maximum lifetime using ssh-add with the t option, require confirmation with the c option for sensitive keys, and prefer FIDO backed keys such as ed25519-sk. A lost or stolen laptop then holds less usable access.
The problem
An SSH private key on a laptop is a long lived credential. If someone takes the laptop and the key has no passphrase, or the agent is unlocked, they can sign in to every server that trusts it. Travel raises the chance of loss, so reduce what is usable at any moment.
Control 1: agent lifetime
The OpenBSD manual page for ssh-add says you can set a maximum lifetime when adding identities to an agent, given in seconds or in a time format. Example:
ssh-add -t 4h ~/.ssh/id_ed25519
After four hours the agent drops the key, and you re-enter the passphrase to use it again. Choose a time that matches a working session, not a whole trip.
Control 2: confirmation per use
The same page describes a confirmation option. When you add a key with it, the agent asks for confirmation before each use for authentication, through an askpass program. This makes silent use by a malicious process harder, since you will see a prompt you did not expect.
ssh-add -c ~/.ssh/id_ed25519
Control 3: hardware backed keys
The ssh-keygen manual page lists ed25519-sk among key types, which are backed by a FIDO authenticator. The private key material stays on the security key, and using it needs the key to be present. It also documents options such as verify-required, which asks for user verification such as a PIN. A thief with the laptop but not the key cannot sign in.
ssh-keygen -t ed25519-sk
Carry the security key on your person, not in the laptop bag. Register a second key and store it at home as a backup.
Control 4: remove what you do not need
Before the trip, list what is in the agent and on disk. Remove keys for systems you will not touch, and do not carry production keys if a personal or staging key will do. For the decision on production access, see Should developers travel with production access?.
Control 5: know the revoke path
You need to know where each public key is trusted: servers, source control, deploy hosts. For GitHub the steps are in How to revoke GitHub access after losing a laptop. Keeping a list makes the response a ten minute job.
Comparison
| Approach | If the laptop is stolen | Cost |
|---|---|---|
| Key with no passphrase, always loaded | Open access | None |
| Passphrase and agent lifetime | Open only while loaded | Re-entering passphrase |
| Confirmation prompts | Needs user to approve use | Extra clicks |
| FIDO security key | Needs the physical key | Hardware to carry |
Also keep full disk encryption on, since it protects the key file at rest.
Safeguard does not manage SSH keys. It does scan dependencies and apply policy gates, which helps limit what a single compromised developer account can push. A free scan shows your current baseline.
Quick check
Does an agent lifetime protect a key file on disk?
No. It limits how long the agent holds the unlocked key. Protect the file with a passphrase and disk encryption.
Can I use a security key with servers that run older software?
Support depends on the server's OpenSSH version. Check before you travel and keep a fallback key.
Sources
Last reviewed: 19 October 2026.
