I would like to have the ssh-agent socket inside my home directory, but currently it is created inside /private/tmp.

I see that the agent is managed though launchctl and this plist: /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist, but I don't know how to modify this file to have the socket, for example, at ~/.ssh-agent.sock.

3 Answers 3


I ended up with the following plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
            <integer>384</integer> <!-- 0600b8 in decimal -->

The only downside is the need for an hard coded username. If somebody know how to solve this as well...

I just overwrote the default file at /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist, then I executed the following commands:

launchctl unload /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist
launchctl load /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist
launchctl start org.openbsd.ssh-agent
  • 1
    how did you edit /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist ? mine is locked (even for root), on latest el-capitan.
    – Max Lobur
    Jun 9, 2016 at 18:52

I end up with a .bashrc script:

# Predictable SSH authentication socket location.
if ! ps -x | fgrep -v fgrep | fgrep -q $SOCK;
    rm -f $SOCK
    ssh-agent -a $SOCK > $AGENT_ENV
eval $(cat $AGENT_ENV)

And sounds like this wont work for GUI as well. Updating plist is too painful on El Capitan (Reboot to recovery & SIP disable -> reboot -> edit plist & test -> reboot to recovery & SIP enable -> reboot), so for those who is OK to have this solved for shell only - this is a working solution.


You could do this basically in two possible ways without tweaking plist files:

  1. If you always use bash in the Terminal and you want to enable that, set the path to your socket global in /etc/bashrc for all users:

    export SSH_AUTH_SOCK=${HOME}/.ssh-agent.sock
  2. Set the SSH_AUTH_SOCK variable in the user's .bashrc script. Same way as in no. 1.

So whenever a user logs in with the command-line and has bash executed, the user always has its AUTH Socket set in the home directory. You may have to do it for other shells in similar ways AND you always have to ensure that the agent directory exists. Of course I cannot guarantee that this will work with GUI clients aka CyberDuck as well.

  • The problem is not configuring my environment, but more starting the ssh-agent with the correct path.
    – GaretJax
    Mar 19, 2015 at 17:02
  • Ok, I got it. You want to use the system procedures, not implementing your own. Because the last thing I would have told you was "ssh-agent -a <SOCKPATH>". That worked for me when testing it on the command line withing iTerm2. Mar 20, 2015 at 11:00
  • Exactly. The downside is that, as you already pointed out, it will only work for that iTerm2 session and not for other GUI apps.
    – GaretJax
    Mar 21, 2015 at 11:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .