On Mac OS 10.7 and 10.8 (separate computers) I've been using a ssh-askpass script to let me verify the use of SSH keys:


However, this does not seem to work on Mavericks/10.9?

Plain SSH keys works fine:

box ~$ ssh-add -D
All identities removed.
box ~$ ssh-add ~/.ssh/id_rsa
Enter passphrase for /Users/user/.ssh/id_rsa: 
Identity added: /Users/user/.ssh/id_rsa (/Users/user/.ssh/id_rsa)
box ~$ ssh remotehost
remotehost ~$

But with -c, it no longer works..

box ~$ ssh-add -D
All identities removed.
box ~$ ssh-add -c ~/.ssh/id_rsa
Enter passphrase for /Users/user/.ssh/id_rsa: 
Identity added: /Users/user/.ssh/id_rsa (/Users/user/.ssh/id_rsa)
The user must confirm each use of the key
box ~$ ssh remotehost
Agent admitted failure to sign using the key.
Password for user@remotehost:

/usr/libexec/ssh-askpass is owned by root and has +x. It does not even get executed it seems (added simple touch a-logfile line, never called).

Any ideas or hints on how to debug further?

3 Answers 3


Problem solved! When in doubt, read the source...

ssh-agent won't call ssh-askpass unless the DISPLAY env variable is set. Most likely it has been working on earlier installations, since I had X11 installed. Not on this box (yet).


Patch the ssh-agent LaunchAgents file:

--- org.openbsd.ssh-agent.plist.orig    2014-05-22 09:55:53.000000000 +0200
+++ /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist    2014-05-22 09:56:31.000000000 +0200
@@ -9,6 +9,11 @@
+   <key>EnvironmentVariables</key>
+   <dict>
+       <key>DISPLAY</key>
+       <string>:0</string>
+   </dict>

Then restart your computer.

Or reload it by force, however SSH_AUTH_SOCK will be invalid in all new terminal sessions:

launchctl unload /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist                        
launchctl load /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist
export SSH_AUTH_SOCK=$(launchctl getenv SSH_AUTH_SOCK)                 
ssh-add -c ....

Problem solved!

Note: the ssh-agent plist file will probably be overwritten on upgrade... Might be cleaner ways to ensure DISPLAY is set.

  • 1
    Finally, an explanation as to the real issue. Indeed, mine must have stopped working after installing X11. Thanks for the info! Should have RTFM myself... Oct 6, 2014 at 8:27
  • Thanks! on OSX 10.9.5, trying to run an automated vagrant process via phpstorm, the process would fail when 'Exporting NFS shared folders... ==> default: Preparing to edit /etc/exports. Administrator privileges will be required...' Failed with error "no askpass" The above tweak seems to have fixed it.
    – dman
    Dec 11, 2014 at 0:05

I'm on 10.9 and @jstrom's solution didn't work for me. For me, the DISPLAY variable was already being set. The problem was a missing ssh-askpass program:

[q@haywire/0 ~] ls /usr/libexec/ssh-askpass
ls: /usr/libexec/ssh-askpass: No such file or directory
(no output)

You can fix this by using a custom ssh-askpass program such as jcs's (requires CocoaDialog) or markcarver's.

I prefer to copy this program to ~/bin/ssh-askpass. This requires specifying this location in the SSH_ASKPASS variable; add this to your ~/.bash_profile:

export SSH_ASKPASS=~/bin/ssh-askpass

You may also need to make this variable available in launchd context:

launchctl setenv SSH_ASKPASS $SSH_ASKPASS

Before it works, you'll need to restart or at least kill and restart the ssh-agent:

killall ssh-agent
ssh-add -c -t 1h
  • As my initial post stated, ssh-askpass from github.com/TimZehta/mac-ssh-confirm was used.
    – jstrom
    Aug 6, 2015 at 21:49
  • Ah, I see. I assumed you were using one that comes bundled in OS X, which I mysteriously didn't have. =) Aug 7, 2015 at 16:22
  • As far as I know, there isn't any askpass bundled.. :)
    – jstrom
    Aug 9, 2015 at 21:09

In addition to using the various replacements for ssh-askpass, I put this code in my ~/.bashrc to ensure the launchd environment is always properly set every time I start a shell. Placing this in ~/.bash_profile did not yield consistent results and this code executes very quickly so running it every time a shell starts isn't an issue.

I set DISPLAY here to avoid having to add it as a key in /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist, plus it avoids having to edit stock plists. I check that display is already set because I don't want to set it blindly if it's already set by something else, say Xquartz.

if [[ "$OSTYPE" == darwin* ]]; then
    env_ssh_askpass="`/bin/launchctl getenv SSH_ASKPASS`"
    if [ "x${env_ssh_askpass}" != "x/opt/libexec/ssh-askpass" ]; then
            /bin/launchctl setenv SSH_ASKPASS /opt/libexec/ssh-askpass
            env_display="`/bin/launchctl getenv DISPLAY`"
            if [ "x${env_display}" == "x" ]; then
                    /bin/launchctl setenv DISPLAY bogon
            /usr/bin/killall -9 ssh-agent 2>&1 >/dev/null

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .