Arch Linux + Plasma + KWallet + systemd ssh-agent

Fully Zero-Password SSH Key Workflow

This guide sets up:

• systemd user ssh-agent
• KWallet auto-unlock via PAM
• Automatic SSH key loading at login
• No password prompts after login
• No race conditions

After setup:

• Login to Plasma
• Wallet unlocks automatically
• ssh-agent starts
• SSH key loads automatically
• ssh, git, etc. work with zero prompts

---

1. Install Required Packages

sudo pacman -S openssh kwallet-pam ksshaskpass

---

2. Enable KWallet Auto-Unlock (PAM)

If using SDDM (default Plasma display manager)

Edit:

sudo nano /etc/pam.d/sddm

Add:

auth       optional     pam_kwallet5.so
session    optional     pam_kwallet5.so auto_start

3. Create systemd User ssh-agent

mkdir -p ~/.config/systemd/user
nano ~/.config/systemd/user/ssh-agent.service

Contents:

[Unit]
Description=SSH Agent

[Service]
Type=simple
Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK

[Install]
WantedBy=default.target

Enable it:

systemctl --user daemon-reload
systemctl --user enable --now ssh-agent

---

4. Export SSH_AUTH_SOCK Globally

mkdir -p ~/.config/environment.d
nano ~/.config/environment.d/ssh-agent.conf

Contents:

SSH_AUTH_SOCK=${XDG_RUNTIME_DIR}/ssh-agent.socket

Log out and back in.

---

5. Store SSH Key Passphrase in KWallet (One Time Only)

DISPLAY=$DISPLAY \
SSH_ASKPASS=/usr/bin/ksshaskpass \
SSH_ASKPASS_REQUIRE=force \
ssh-add ~/.ssh/id_ed25519

Check “remember password” in the popup.

---

6. Auto-Load SSH Key at Plasma Login (Race-Free)

nano ~/.config/systemd/user/ssh-add.service

Contents:

[Unit]
Description=Auto add SSH key via KWallet
After=ssh-agent.service graphical-session.target
Requires=ssh-agent.service

[Service]
Type=oneshot
Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
Environment=SSH_ASKPASS=/usr/bin/ksshaskpass
Environment=SSH_ASKPASS_REQUIRE=prefer
ExecStart=/bin/sh -c 'ssh-add ~/.ssh/id_ed25519 </dev/null'

[Install]
WantedBy=graphical-session.target

Enable it:

systemctl --user daemon-reload
systemctl --user enable ssh-add.service

Log out and log back in.

---

7. Verify

After login:

ssh-add -l

Your key should already be loaded.

---

Resulting Login Flow

1. PAM unlocks KWallet using login password
2. systemd user ssh-agent starts
3. ssh-add service runs
4. KWallet provides passphrase silently
5. SSH key is loaded automatically

Fully zero-password SSH workflow achieved.