26

After creating a new encrypted id-rsa key file with ssh-keygen and using it for the first time, I cannot get macOS to forget the passphrase. This is similar to how to make OS X not remember ssh key passphrase question but worse.

I tried rebooting, killing the ssh-agent, locking all my keychains but it still seems to be stored somewhere. However, I cannot find it in any keychains. This seems to be very insecure. The answers to SSH private key password never removed with Keychain/ssh-agent also do not help.

In fact, the dialog that used to appear asking you whether you wanted to store the passphrase or not does not seem to exist anymore.

Improve this question
8
  • Did you check if it's actually encrypted at all?
    – John Keates
    Sep 22, 2016 at 0:34
  • Yeah. Pretty sure it is as ssh does ask for the passphrase the first time I use it. Can someone actually reproduce this?
    – hogliux
    Sep 22, 2016 at 5:40
  • Well, it works that way with my setup too, it's the way ssh/ssh-agent was configured.
    – John Keates
    Sep 22, 2016 at 13:11
  • That's true if you click the checkbox to tell macOS to store the passphrase in the keychain. However, if you don't click that checkbox macOS should always ask for the passphrase. But even if you did click it, you were always able to remove it again in the keychain utility. Since Sierra the dialog box does not appear anymore and there is no entry in keychain utility.
    – hogliux
    Sep 23, 2016 at 7:35
  • This is the dialog box I'm talking about which does not seem to exist anymore: dribin.org/dave/resources/pictures/ssh_leopard_dialog.png
    – hogliux
    Sep 23, 2016 at 7:36

3 Answers 3

Reset to default
28

To disable storing passphrase in keychain you should add following lines to ~/.ssh/config file:

Host *
UseKeyChain no

If you already have passphrase stored in keychain you can delete it using commands:

cd ~/Library/Keychains/<UUID>/
sqlite3 keychain-2.db 'delete from genp where agrp="com.apple.ssh.passphrases"'

If you would like to have a behavior like in OS X El Capitan or earlier (i.e. passphrase stored until logout or restart) simply add to ~/.ssh/config:

AddKeysToAgent yes

You don't need to start ssh-agent.

Improve this answer
3
  • 1
    This answer permanently solves the problem! So I marked this as the correct answer. Thank you!
    – hogliux
    Oct 12, 2016 at 7:40
  • suggested edit: change Library/Keychains/<UUID>/ to ~/Library/Keychains/<UUID>/ for clarity:)
    – Mohamed Hafez
    Oct 15, 2016 at 19:01
  • suggested edit accepted :)
    – mbamac
    Oct 19, 2016 at 5:49
20

Thanks to Clive, I have a better understanding of this new 'feature'. When you type in your passphrase Sierra adds it to your Keychain but not to the ssh-agent. If your identity isn't in ssh-agent there is no way to manage it with ssh-add. To manage (ie. remove) your identity from Keychain you need to add your identity to ssh-agent by using ssh-add. Once you have added your identity to ssh-agent you can use ssh-add -K -d to remove it from both ssh-agent and Keychain. If you want your identity to be added to ssh-agent every time you use ssh add:

AddKeysToAgent yes

to your .ssh/config. This will ensure that ssh-agent always has your identity.

Improve this answer
2
  • Just a followup. If you add 'UseKeyChain no' to your .ssh/config it will keep Keychain from adding your passphrase. You want to keep 'AddKeysToAgent yes' in ssh-agent will keep your passphrase until you reboot or use ssh-add -d.
    – Gene Frenkler
    Oct 7, 2016 at 13:33
  • Note this requires the use of the OpenSSH shipped by Apple. This patch isn't included in home-brew as of homebrew/dupes/openssh: stable 7.3p1
    – Ryan Gibbons
    Oct 10, 2016 at 19:35
3 
ssh-add -K -d

This can remove passphrases previously stored in the keychain. Since macOS 10.12 Sierra, to avoid the passphrase stored in the keychain again, be sure to do ssh-add first.

Improve this answer
3
  • Yes. This used to work on previous versions of macOS Sierra. But doesn't work anymore. macOS Sierra still remembers the passphrase.
    – hogliux
    Sep 23, 2016 at 7:17
  • 1
    OK. More investigation. It does forget it once but it will go straight back into the keychain after using it anywhere (ssh, scp, git etc.). Some kind stranger e-mailed me directly and found out that the passphrase seems to be stored in ~/Library/Keychains/<SOME-UUID>/keychain-2.db. But even when locking my login keychain (and all other keychains), os x will not ask for my keychain password when accessing the passphrase. That really doesn't seem right.
    – hogliux
    Sep 23, 2016 at 11:39
  • Indeed it seems that in Sierra the passphrase is being saved in that keychain location and not the usual Login keychain.
    – m1keil
    Sep 30, 2016 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .