25

After creating a new encrypted id-rsa key file with ssh-keygen and using it for the first time, I cannot get macOS to forget the passphrase. This is similar to how to make OS X not remember ssh key passphrase question but worse.

I tried rebooting, killing the ssh-agent, locking all my keychains but it still seems to be stored somewhere. However, I cannot find it in any keychains. This seems to be very insecure. The answers to SSH private key password never removed with Keychain/ssh-agent also do not help.

In fact, the dialog that used to appear asking you whether you wanted to store the passphrase or not does not seem to exist anymore.

  • Did you check if it's actually encrypted at all? – John Keates Sep 22 '16 at 0:34
  • Yeah. Pretty sure it is as ssh does ask for the passphrase the first time I use it. Can someone actually reproduce this? – hogliux Sep 22 '16 at 5:40
  • Well, it works that way with my setup too, it's the way ssh/ssh-agent was configured. – John Keates Sep 22 '16 at 13:11
  • That's true if you click the checkbox to tell macOS to store the passphrase in the keychain. However, if you don't click that checkbox macOS should always ask for the passphrase. But even if you did click it, you were always able to remove it again in the keychain utility. Since Sierra the dialog box does not appear anymore and there is no entry in keychain utility. – hogliux Sep 23 '16 at 7:35
  • This is the dialog box I'm talking about which does not seem to exist anymore: dribin.org/dave/resources/pictures/ssh_leopard_dialog.png – hogliux Sep 23 '16 at 7:36
27

To disable storing passphrase in keychain you should add following lines to ~/.ssh/config file:

Host *
UseKeyChain no

If you already have passphrase stored in keychain you can delete it using commands:

cd ~/Library/Keychains/<UUID>/
sqlite3 keychain-2.db 'delete from genp where agrp="com.apple.ssh.passphrases"'

If you would like to have a behavior like in OS X El Capitan or earlier (i.e. passphrase stored until logout or restart) simply add to ~/.ssh/config:

AddKeysToAgent yes

You don't need to start ssh-agent.

  • 1
    This answer permanently solves the problem! So I marked this as the correct answer. Thank you! – hogliux Oct 12 '16 at 7:40
  • suggested edit: change Library/Keychains/<UUID>/ to ~/Library/Keychains/<UUID>/ for clarity:) – Mohamed Hafez Oct 15 '16 at 19:01
  • suggested edit accepted :) – mbamac Oct 19 '16 at 5:49
20

Thanks to Clive, I have a better understanding of this new 'feature'. When you type in your passphrase Sierra adds it to your Keychain but not to the ssh-agent. If your identity isn't in ssh-agent there is no way to manage it with ssh-add. To manage (ie. remove) your identity from Keychain you need to add your identity to ssh-agent by using ssh-add. Once you have added your identity to ssh-agent you can use ssh-add -K -d to remove it from both ssh-agent and Keychain. If you want your identity to be added to ssh-agent every time you use ssh add:

AddKeysToAgent yes

to your .ssh/config. This will ensure that ssh-agent always has your identity.

  • Just a followup. If you add 'UseKeyChain no' to your .ssh/config it will keep Keychain from adding your passphrase. You want to keep 'AddKeysToAgent yes' in ssh-agent will keep your passphrase until you reboot or use ssh-add -d. – Gene Frenkler Oct 7 '16 at 13:33
  • Note this requires the use of the OpenSSH shipped by Apple. This patch isn't included in home-brew as of homebrew/dupes/openssh: stable 7.3p1 – Ryan Gibbons Oct 10 '16 at 19:35
3
ssh-add -K -d

This can remove passphrases previously stored in the keychain. Since macOS 10.12 Sierra, to avoid the passphrase stored in the keychain again, be sure to do ssh-add first.

  • Yes. This used to work on previous versions of macOS Sierra. But doesn't work anymore. macOS Sierra still remembers the passphrase. – hogliux Sep 23 '16 at 7:17
  • 1
    OK. More investigation. It does forget it once but it will go straight back into the keychain after using it anywhere (ssh, scp, git etc.). Some kind stranger e-mailed me directly and found out that the passphrase seems to be stored in ~/Library/Keychains/<SOME-UUID>/keychain-2.db. But even when locking my login keychain (and all other keychains), os x will not ask for my keychain password when accessing the passphrase. That really doesn't seem right. – hogliux Sep 23 '16 at 11:39
  • Indeed it seems that in Sierra the passphrase is being saved in that keychain location and not the usual Login keychain. – m1keil Sep 30 '16 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .