Password dialog appears for password-less SSH private key

Question

I installed my SSH private key in ~/.ssh/id_rsa. There is no passphrase associated with the key, however, whenever I connect to an SSH server, a dialog pops up and asks me to enter my password to access the id_rsa file.

If I cancel the dialog or enter an empty passphrase and click OK, the Terminal prompts me for a passphrase.

I have verified that the key is valid and does not require a password by connecting with the same key via other machines.

Something odd about my particular set-up is causing the problem but I can't figure it out. I'm currently running OSX 10.7.1 but the same problem was occurring with OSX 10.6.8

Answer 1

I had this same problem. However, when a generated a new password-less private key, using the following command:

ssh-keygen -b 1024 -t rsa -f id_rsa -P ""

I no longer saw the password prompt.

Additionally, ssh-add failed to add the old key, but added the new one as expected.

I generated the old key on Leopard in 2009, using what ever version of OpenSSL I had grabbed, built and installed back then (that Mac died, so I can't log in and check what I was running). Something about that key was incompatible with Lion's native SSL libraries.

I backed up my old key, so if anyone wants to suggest some checks, to identify the key's specific properties, let me what to check and I'll report back.

Another clue - I noticed that my old id_rsa.pub file had extended attributes. i.e. it's permissions flags looked like this r--------@ instead of r--------

xattr -l id_rsa.pub.old

returned:

com.macromates.caret: {
    column = 0;
    line = 1;
}

cruft left over from TextMate. I don't know if removing it would have fixed the issue without my having to replace the key. I think it's unlikely.

In case you (future reader) are seeing the same thing, you can remove the extended attribute as follows:

 xattr -d com.macromates.caret id_rsa.pub.old

You can stop TextMate from adding them by first exiting TextMate and then issuing this command:

defaults write com.macromates.textmate OakDocumentDisableFSMetaData 1

Answer 2

For me, I have found that some stray text or an imperfection in the keyfile can cause this prompt. The latest for me was this:

-----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----

Notice the extra space there. That was causing this bizarre password prompt to appear on this passwordless key.

Answer 3

Older versions of the ssh utility will ask for a passphrase any time it can't interpret the key file. If ssh asks for a passphrase on a key file which isn't supposed to have one, it probably means the key file is corrupt in some way.

$ dd if=/dev/urandom of=randokey bs=1024 count=1
1+0 records in
1+0 records out
1024 bytes (1.0 kB) copied, 0.000380502 s, 2.7 MB/s
$ chmod 600 randokey
$ ssh -i randokey localhost
Enter passphrase for key 'randokey':

The OpenSSH maintainers improved this behavior at some point. The version of ssh which comes with macOS High Sierra knows the difference between an encrypted key and a corrupt key:

$ ssh -i randokey localhost
Load key "randokey": invalid format
Password: ^C

$ ssh -V
OpenSSH_7.6p1, LibreSSL 2.6.2
$ uname -a
Darwin [hostname] 17.4.0 Darwin Kernel Version 17.4.0: Sun Dec 17 09:19:54 PST 2017; root:xnu-4570.41.2~1/RELEASE_X86_64 x86_64