I recently started using Git with GitHub and thus discovered that I already have a generated pair of SSH keys, public and private. This leads me to ask: what applications/programs/daemons on my Mac might have caused this keypair to be created? I've never used SSH to log in to another machine.
4 Answers
To be honest the question is a little bit huge. Your ssh keys could have been generated if you activated the sshd (Remote Login) from the sharing preference pane; as to what could have used (or uses them), it’s any program (like Git, Subversion, SFTP, etc) that requires ssh access. Not sure exactly which one could have generated for you, but you can always remove them and see what fails (save a backup!).
answered Sep 6, 2010 at 10:02
-
Remote Login is off (I just checked). I've never used an SSH/SFTP client, and before Git a few days ago, never used a VCS over the network. Thanks for having a go at the question, though. I'd mod you up if I had the rep!– YawarSep 6, 2010 at 19:06
-
Anytime, sorry I can’t really give you more info. Maybe you activated Remote Login once and then disabled it? The keys would still be there. Sep 6, 2010 at 23:08
-
1Visitors: Please note this answer is not correct. Enabling Remote Login / SSH daemons will generate server side SSH keys, but those are located in
/etc/ssh, not~/.ssh/like the op indicates. Jan 6, 2012 at 21:17 -
-1 for misinformation (as @JasonSalaz stated). Should be edited or possibly removed. Oct 10, 2012 at 7:31
Amusingly, your own question includes the answer. GitHub for Mac uses Git via SSH, and will automatically generate unprotected SSH key pairs (e.g. no passphrase) in order to push/pull contents between the remote repo and your local ones.
answered Jan 6, 2012 at 21:15
The program to create SSH key pairs is ssh-keygen.
Enabling the SSH daemon in the Sharing preference pane does not create a key pair for a user in ~/.ssh/ The SSH daemon only creates a SSH host key pair in /etc/ssh_host*_key*
If you haven't used ssh-keygen to create the keys, maybe some other program did it for you. I don't know which one does that but I haven't used git.
As for using the keys, every program that uses SSH can use the keys. Some, like ssh, use the keys automatically, in some, like Cyberduck (SFTP), you have to select the key file manually.
Break out
fs_usage(1)
or
opensnoop(1m)
Both of these commands have options to watch a directory, or a path. Open a terminal and , well, watch ~/.ssh . See who actually accesses that path. If you find a program that is accessing that path illicitly, then tell us all. Please.
