24

I love ssh -A, which allows me to use my local ssh key when establishing a connection from a remote server. For example, I ssh -A host1.example.com and then from there I can ssh host2.example.com (or use git) and it uses my ssh key from the original machine, which in this case should be my mac. Although this has always worked for me on Debian/Ubuntu, it doesn't work on my new mac (Lion).

What am I missing here? How do I configure ssh to work correctly with -A? Do I need an ssh that is not the standard MacOS one?

3 Answers 3

41

Actually, the very simple answer is that you have to run

ssh-add

and then it all works.

Basically, macOS already has the ssh-agent set up for you, but after each reboot you need to add your keys to it. ssh-add gives ssh-agent access to your keys for the current boot cycle. You'll have to enter the password for your private key if you have created one.

3
  • 1
    That solved my latest ssh forwarding problem after the upgrade to macOS (after 5 years, still a useful answer, thanks @rfay)
    – 23tux
    Feb 6, 2017 at 11:35
  • 1
    This does work, but some explanation of why would be useful/help people remember this command. May 29, 2018 at 18:52
  • 2
    @AdamParkin added another paragraph explaining.
    – rfay
    May 30, 2018 at 19:54
3

As of OS X 10.8 you need to do this once:

sudo touch /var/db/useLS

And add this as part of your ~/.bash_profile:

if [ -f ~/.ssh/id_rsa ]; then
    ssh-add -K ~/.ssh/id_rsa 2>/dev/null
fi

Note: this recipe is parto of my bedouin scripts.

3
  • Hm, just tried this out; the agent does then start, but you still have to ssh-add to get anything to work. So ssh-add alone is still the answer, as far as I understand. I guess I should add it to my .bash_profile.
    – rfay
    Jan 19, 2013 at 14:53
  • lol, what if my private key needs a passphrase?
    – Jeffrey04
    Oct 23, 2015 at 3:05
  • 1
    As shown in this answer, if your key requires a passphrase, the macOS-specific -K option will store your key's passphrase in your Keychain.
    – beporter
    Jun 5, 2020 at 0:09
1

The concept behind ssh -A are ssh agents. They run in the background and through the use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh. Have a look at the manpage of ssh-agent for more details.

With Mac OS X, the ssh-agent should be started on demand.

For more information see:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .