11

I have a private SSH key I use for authentication that is stored in ~/.ssh/id_rsa. When I ssh into a server, I am prompted for the password to unlock the key:

enter image description here

I like this. I also like that I can ssh again and again and it doesn't prompt me for my password.

What I don't like is that I am not required to enter my key password days or even weeks later. I can lock my screen or put it to sleep and I still don't have to enter my key password. The only time it seems to expire the password is when I logout (which I do rarely).

How do I get the key password to expire after a while, forcing me to enter my password again to authenticate? Making it so that perhaps after 1 hour, the key is automatically forgotten.

Improve this question

4 Answers 4

Reset to default
5

Rather than tweaking ssh-agent (which now requires silly amounts of hacking), I strongly recommend simply changing the settings on your default (login) keychain. I use the very helpful 'lock on sleep' as well as 'lock after 4 hours' because I don't want prompts unless I'm actually afk.

Open Keychain Access and right-click the login keychain to change settings: Keychain Security Settings

Or if you prefer a commandline:

security set-keychain-settings -lu -t 14400

This will result in at least one extra prompt for unlocking the keychain itself (requiring your login password) as well as the prompt for whichever key you're trying to use... but it beats disabling System Integrity Protection IMO.

Improve this answer
2
  • This isn't an option in El Capitan for me, and the commandline command doesn't seem to make any difference, do you know if there is a similar option in El Capitan somewhere ?
    – Ian
    Oct 16, 2016 at 17:37
  • 1
    Pretty sure I was able to do this on El Cap - I've just checked and both methods (UI and cmdline) certainly still work on Sierra. I can only do it on the login keychain, though, not System or iCloud.
    – Dave Gregory
    Oct 17, 2016 at 8:43
8

You need to set the life of the key. It ordinarily defaults to forever.

When you run ssh-add you want to use the -t option. If you want a key life of one hour then it is ssh-add -t 1h. The time formats can be seen in the sshd_config man page but put simply they are a number followed by s, m, h, d, or w for seconds, minutes, hours, days or weeks.

ssh-add can be put into your .bashrc file and it will just ask you to validate the key once. Even when the key "expires" it isn't removed - it just asks for the passphrase again when an attempt is made to use it.

The other option would be to alter the launch options for ssh-agent which are stored in /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist and add the -t there. (I use LaunchControl for changing these but you can do it by hand if you are careful.)

Improve this answer
2
  • I'd rather not have to remember to run ssh-add manually before I run ssh every time. It's interesting, but I'm really looking for something automatic.
    – Michael Kropat
    Jan 22, 2014 at 4:14
  • +1 thanks for pointing me to the org.openbsd.ssh-agent.plist solution
    – Michael Kropat
    Jan 25, 2014 at 5:55
8

Note: in newer versions of OS X you must disable System Integrity Protection for this answer to work. (Thanks to @Dave Gregory and @Jaap for pointing this out.)

Open /System/Library/LaunchAgents/com.openssh.ssh-agent.plist (in older versions: org.openbsd.ssh-agent.plist) in a text editor. Replace:

<key>ProgramArguments</key>
<array>
    <string>/usr/bin/ssh-agent</string>
    <string>-l</string>
</array>

with:

<key>ProgramArguments</key>
<array>
    <string>/usr/bin/ssh-agent</string>
    <string>-l</string>
    <string>-t</string>
    <string>30m</string>
</array>

This will expire the key after 30 minutes.

Reboot. Wait, reboot?!? This isn't Windows! Yes, reboot.

Well, you can try to decipher the instructions for changing the setting on the fly, but good luck.

Improve this answer
6
  • 1
    A pedant like me would replace the "1800" with "30m" as it makes it a little easier to read. See TIME FORMATS in sshd_config(8) for the full format.
    – Tony Williams
    Jan 25, 2014 at 9:04
  • @Tony Williams cool! fixed
    – Michael Kropat
    Jan 25, 2014 at 19:08
  • This doesn't seem to be working for me on Yosemite; anyone else?
    – Dave Gregory
    Aug 26, 2015 at 11:01
  • I found a workaround on Yosemite that doesn't involve disabling System Integrity Protection; added as an answer below.
    – Dave Gregory
    Nov 30, 2015 at 17:43
  • 1
    Thanks for the info @Jaap. I don't use OS-X day-to-day currently so I can't verify anything personally, but to try and be a good steward of this Q&A I updated my answer based on your info and changed the accepted answer to Dave Gregory's because disabling System Integrity Protection seems inadvisable in many cases.
    – Michael Kropat
    Jan 24, 2017 at 15:53
1

An other solution is:

ssh-add -t <time> <ssh-private-key>  # Set maximum lifetime to your SSH priv key.
killall ssh-agent                    # Kill all ssh-agent processes.
ssh-add -D                           # Delete all identities recorded by the agent.

With this solution, you do not have to choose a timeout to all your keychain - quite annoying when you want to set a timeout of some seconds to your private key password recording - and you do not have to disable your SIP to edit /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .