3

I installed my SSH private key in ~/.ssh/id_rsa. There is no passphrase associated with the key, however, whenever I connect to an SSH server, a dialog pops up and asks me to enter my password to access the id_rsa file.

If I cancel the dialog or enter an empty passphrase and click OK, the Terminal prompts me for a passphrase.

I have verified that the key is valid and does not require a password by connecting with the same key via other machines.

Something odd about my particular set-up is causing the problem but I can't figure it out. I'm currently running OSX 10.7.1 but the same problem was occurring with OSX 10.6.8

  • Did you try selecting "Remember password in my keychain" in the authentication dialog? – Chris Page Sep 13 '11 at 20:13
  • Yes, I've tried selecting the remember checkbox. I've also tried using a blank password and clicking OK and also simply canceling the dialog box. But all of this seems beside the point: It should NOT be prompting me for a passphrase because there is no passphrase associated with the key. It is a private, passwordless key. – JeremyT Sep 20 '11 at 22:21
  • Ah, I see. Please file a bug report at developer.apple.com/bugreporter to make sure Apple knows this is a problem for you. – Chris Page Sep 21 '11 at 7:57
  • In my case it turned out that I had put a passphrase on the private key. It was so long ago that I had forgotten it was still in the keychain. When I moved the files to a new machine, I couldn't figure out why they didn't work. Luckily I still had the passphrase in my notes. D'oh! – Hew Wolff Dec 4 '14 at 18:43
2

I had this same problem. However, when a generated a new password-less private key, using the following command:

ssh-keygen -b 1024 -t rsa -f id_rsa -P ""

I no longer saw the password prompt.

Additionally, ssh-add failed to add the old key, but added the new one as expected.

I generated the old key on Leopard in 2009, using what ever version of OpenSSL I had grabbed, built and installed back then (that Mac died, so I can't log in and check what I was running). Something about that key was incompatible with Lion's native SSL libraries.

I backed up my old key, so if anyone wants to suggest some checks, to identify the key's specific properties, let me what to check and I'll report back.

Another clue - I noticed that my old id_rsa.pub file had extended attributes. i.e. it's permissions flags looked like this r--------@ instead of r--------

xattr -l id_rsa.pub.old

returned:

com.macromates.caret: {
    column = 0;
    line = 1;
}

cruft left over from TextMate. I don't know if removing it would have fixed the issue without my having to replace the key. I think it's unlikely.

In case you (future reader) are seeing the same thing, you can remove the extended attribute as follows:

 xattr -d com.macromates.caret id_rsa.pub.old

You can stop TextMate from adding them by first exiting TextMate and then issuing this command:

defaults write com.macromates.textmate OakDocumentDisableFSMetaData 1
  • My original file didn't have any extended properties, but it was generated by putty-keygen on Windows; when I recreated a new private/public key pair without a passphrase, it worked like a charm. – cori May 11 '13 at 14:55
1

For me, I have found that some stray text or an imperfection in the keyfile can cause this prompt. The latest for me was this:

-----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----

Notice the extra space there. That was causing this bizarre password prompt to appear on this passwordless key.

0

Older versions of the ssh utility will ask for a passphrase any time it can't interpret the key file. If ssh asks for a passphrase on a key file which isn't supposed to have one, it probably means the key file is corrupt in some way.

$ dd if=/dev/urandom of=randokey bs=1024 count=1
1+0 records in
1+0 records out
1024 bytes (1.0 kB) copied, 0.000380502 s, 2.7 MB/s
$ chmod 600 randokey
$ ssh -i randokey localhost
Enter passphrase for key 'randokey':

The OpenSSH maintainers improved this behavior at some point. The version of ssh which comes with macOS High Sierra knows the difference between an encrypted key and a corrupt key:

$ ssh -i randokey localhost
Load key "randokey": invalid format
Password: ^C

$ ssh -V
OpenSSH_7.6p1, LibreSSL 2.6.2
$ uname -a
Darwin [hostname] 17.4.0 Darwin Kernel Version 17.4.0: Sun Dec 17 09:19:54 PST 2017; root:xnu-4570.41.2~1/RELEASE_X86_64 x86_64

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .