ControlMaster, and the credential-broker pattern

infrastructure
SSH ControlMaster reuses one authenticated connection, its real purpose is speed. The pattern worth borrowing is the credential broker: the agent never holds the secret.
Author

Chris Sweet

Published

July 9, 2026

What SSH ControlMaster actually is. ControlMaster is a stock OpenSSH client feature (since 2004), turned on with a few directives in your ssh_config:

# ~/.ssh/config
Host crc
    HostName        crcfe01.crc.nd.edu
    ControlMaster   auto
    ControlPath     ~/.ssh/cm-%r@%h:%p
    ControlPersist  10m

The first connection to a host does the full handshake, TCP, encryption, authentication, and opens a local control socket; every later session to the same host reuses that socket and skips the handshake. Its real purpose is speed: it removes the per-connection setup cost, which matters for automation and deployments that open many short SSH sessions. Security is not why it exists.

The pattern worth stealing: the credential broker. Reaching a credentialed source safely comes down to one rule: the thing doing the reasoning never holds the secret. A separate, non-LLM component, a credential broker (sometimes a “secretless broker”), holds the real credential; the agent sends a request with a placeholder, and the broker swaps the secret in as the request leaves. The threat model is explicit and current for AI agents: prompt injection, a confused tool call, or a sandbox breach. If the agent never held the secret, it cannot leak one. This is an established pattern with real tooling (CyberArk’s Secretless Broker, secrets managers, sidecar proxies).

Why we point at ControlMaster. We borrow ControlMaster as a ready-made instance of that shape. Accessing Notre Dame’s CRC, one master connection authenticates once (SSH key plus a Duo two-factor prompt), and every downstream operation rides the authenticated socket without re-authenticating. Map it onto the rule and it lines up: the socket is the broker; the agent talks to the socket, never the key or the 2FA; the human authorizes the master once; killing it revokes. It is a coarse broker, honestly, a ControlMaster session carries full shell privilege, not a narrowly scoped permission, and it is campus-local. But it demonstrates the architecture: authenticate once out of band, hand the agent a delegated channel. And the same seam that holds an SSH key or a login token today could present a verifiable credential tomorrow.

Sources