1

I work in a HIPAA environment where we purposefully put passwords on our certificates. However, when connecting to one of our servers via SSH, it seems keychain is 'remembering' the password between restarts and hasn't been prompting me each time (as it needs to).

How can I disable this session-like behavior, so certificate passwords produce a prompt each time they are used?

2

When the system prompts you to save your session in the following dialog:

SSH Keychain

Make sure that you do NOT check the Remember password in my keychain checkbox. If you did check that, then you can always delete that saved password in the Keychain Access app, located in your Utilities folder:

Keychain Access

Notice that even if you don't check the box, SSH does cache your password until a reboot.

Dave Dribin has an excellent breakdown of what's actually going on with OS X's SSH Keychain integration: http://www.dribin.org/dave/blog/archives/2007/11/28/ssh_agent_leopard/

Summary:

The real benefit, though, is the second checkbox: “Remember password in my keychain.” While it does store the passphrase in your keychain, it actually does more than that. It also adds the identity to your ssh-agent for you.

By adding your identity to the agent, you can now log right back into the same machine, without typing any passphrase. However, ssh does not prompt for you passphrase because it gets it from the agent, not your keychain. Remove your identity from the agent, and try again:

% ssh-add -D
All identities removed.

Locking your Keychain

The other thing to consider is just locking your keychain after a reboot or sleeping. This will essentially give you the behavior that you're looking for as well.

You can do this from the Keychain Access utility, by right-clicking on the keychain that your private key's password is saved in, and clicking on Change Settings for Keychain '<YOUR_KEYCHAIN_NAME>'

The following dialog will appear:

Keychain Access 2

Just select the one that best fits your compliance requirements.

0

sorry assuming using a mac. open favorite text editor, bbedit, textwrangler, vi, etc,..

cd ~
cd .ssh
vi knownhosts

locate the shared key
delete all of them, if there are multiple.
save and ssh to server and they will negotiate again.

-x
  • This doesn't make a difference. Known hosts are saved automatically when using SSH. – Qix May 7 '15 at 17:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .