# macOS Sierra doesn’t seem to remember SSH keys between reboots

I have to run this command since upgrading to macOS:

ssh-add -K


Corrects the problem after the reboot but I have to run this command every time I log on to my computer.

If I do not run the command above, my keys in ~/.ssh are skipped and I am being asked server password in order to establish the connection.

• ssh-add -K gives me ssh-add: illegal option -- K – modius Oct 2 '16 at 11:58 • You will need to enter the private key path after -K. See @JakeGould 's answer for resolution. – bisherbas Oct 2 '16 at 13:49 • The 10.12.2 update eliminated some unnecessary server password requests for me. You may now no longer need to run the ssh-add -K. – Wayfaring Stranger Dec 16 '16 at 13:22 • – Ben Creasy Feb 18 '18 at 23:41 ## 10 Answers As of macOS Sierra 10.12.2 Apple added an ssh_config option called UseKeychain which allows a 'proper' resolution to the problem. Add the following to your ~/.ssh/config file: Host * AddKeysToAgent yes UseKeychain yes  From the ssh_config man page on 10.12.2: UseKeychain On macOS, specifies whether the system should search for passphrases in the user's keychain when attempting to use a particular key. When the passphrase is provided by the user, this option also specifies whether the passphrase should be stored into the keychain once it has been verified to be correct. The argument must be 'yes' or 'no'. The default is 'no'. • According to this link: openradar.appspot.com/27348363 Apple has "re-aligned [their] behavior with the mainstream OpenSSH in this area". – ThomasW Dec 16 '16 at 6:11 • It's absurd that Apple modified behaviour in a way which will cause issues for the vast majority of developers (because of GitHub push if nothing else) and said nothing to anyone! – mluisbrown Dec 16 '16 at 12:58 • I think the IdentityFile ~/.ssh/id_rsa is redundant and not needed (when looking at default options). I've never set that option in my ssh config file. – therealmarv Dec 19 '16 at 11:15 • @JakeGould IMO changing ~/.ssh/config~ is preferable as it solves the problem at the ssh level. Not 100% sure that the .bash_profile mod will work for GUI clients using ssh without using a shell. – mluisbrown Dec 20 '16 at 16:25 • Apple published Technical Note TN2449 regarding that change. – Kentzo Mar 3 '17 at 22:08 I had this issue as well when attempting to deploy some code using Capistrano. Very frustrating. Here are two methods I know of to deal with this issue. ### Method 1: Add all known keys to the SSH agent. So one solution I found is to run ssh-add with the -A option—which adds all known identities to the SSH agent using any passphrases stored in your keychain—like this: ssh-add -A  Now this works but it won’t persist across reboots. So if you want to never worry about this again, just open up your user’s ~/.bash_profile file like this: nano ~/.bash_profile  And add this line to the bottom: ssh-add -A 2>/dev/null;  Now when you open a new Terminal window, all should be good! ### Method 2: Add only SSH keys that are in the keychain to the agent. So while the ssh-add -A option should work for most basic cases, I ran into an issue recently where I had 6-7 Vagrant boxes (which uses SSH keys/identities for access) setup on a machine on top of the more common id_rsa.pub in place. Long story short, I ended up being locked out of a remote server due to too many failed tries based on SSH keys/identities since the server access was based on a password and SSH keys/identities are SSH keys/identities. So the SSH agent tried all of my SSH keys, failed and I couldn’t even get to the password prompt. The problem is that ssh-add -A will just arbitrarily add every single SSH key/identity you have to the agent even if it’s not necessary to do so; such as in the case of Vagrant boxes. My solution after much testing was as follows. First, if you have more SSH keys/identities added to your agent than you need—as shown with ssh-add -l then purge them all from the agent like so: ssh-add -D  With that done, then start the SSH agent as a background process like so: eval "(ssh-agent -s)"


Now, it gets weird and I am not too sure why. In some cases you can specifically add the ~/.ssh/id_rsa key/identity to the agent like so:

ssh-add ~/.ssh/id_rsa


Type in your passphrase, hit Return and you should be good to go.

But in other cases simply running this is enough to get the key/identity added:

ssh-add -K


If that’s all worked, type in ssh-add -l and you should see one lone SSH key/identity listed.

All good? Now open up your .bash_profile:

nano ~/.bash_profile


And add this line to the bottom; comment or remove the -A version if you have that in place:

ssh-add -K 2>/dev/null;


That will allow the SSH key/identity to be reloaded to the SSH agent on each startup/reboot.

### UPDATE: Apple has now added a UseKeychain option to the open SSH config options and considers ssh-add -A a solution as well.

As of macOS Sierra 10.12.2, Apple has added a UseKeychain config option for SSH configs. Checking the man page (via man ssh_config) shows the following info:

UseKeychain
On macOS, specifies whether the system should search for
passphrases in the user's keychain when attempting to use a par-
ticular key. When the passphrase is provided by the user, this
option also specifies whether the passphrase should be stored
into the keychain once it has been verified to be correct.  The
argument must be yes'' or no''.  The default is no''.


Which boils down to Apple seeing the solution as either adding ssh-add -A to your .bash_profile as explained in this Open Radar ticket or adding UseKeychain as one of the options in a per user ~/.ssh/config.

• @modius: if you have a pw protected key, do ssh-add -K [path to key] and enter pw when prompted. Keychain will store password and ssh-add will get it from there after that. – Timo Oct 3 '16 at 7:32
• Note the -A is for adding identities to the agent using any passphrases stored in your keychain. If you additionally have identities without passphrases, you will need to omit the -A option to add them to your agent. – Evan Pon Oct 12 '16 at 16:57
• Just to add a bit more visibility to this, Apple has update the man page for ssh_config to include UseKeychain and AddKeysToAgent to automatically add your keys from your ssh_config. No shell scripting needed. See @mluisbrown answer below for the updated info for 10.12.2 – Ryan Gibbons Dec 15 '16 at 22:47
• @JakeGould I get what you are saying, I actually like what they are doing. Instead of automatically saving the passphrase to the Keychain and loading it on boot, they are giving you control of your security. /shrug – Ryan Gibbons Dec 16 '16 at 21:47
• @RyanGibbons FWIW, look at the official suggestion from Apple Developer Relations in this answer on OpenRadar: “You can fix this pretty easily by running ssh-add -A in your rc script if you want your keys to always be loaded.” ¯\_(ツ)_/¯ – Giacomo1968 Dec 19 '16 at 23:58

As explained here, this is the recommended method since macOS 10.12.2:

1. Add the following lines to your ~/.ssh/config file:

Host *
UseKeychain yes

2. Any key you add to the ssh-agent using the ssh-add /path/to/your/private/key/id_rsa command will be automatically added to the keychain, and should be autoloaded upon reboot.

• Other answers tell you to add the IdentityFile ~/.ssh/id_rsa line, but that option is not needed for autoloading the keys (and it'll actually bind that particular key for the host section your add it to, which you won't want if you use different keys for different hots).
• The accepted answer mentions UseKeychain, but that is not enough to persist the keys in ssh-agent after a reboot.
• Regarding second point. Just how sure are you? Nothing actually happens upon reboot and it is not mentioned in your reference material either. What does happen with the above config is that your SSH client will load the key into agent upon first connection (and it will also fetch the passphrase from keychain), then the key will stay loaded. You can verify this statement by listing the keys right after reboot via ssh-add -L and it will report The agent has no identities. Nothing will be there until you connect. The AddKeysToAgent does not persist keys between reboots in any way! – Danila Vershinin Jan 10 '19 at 21:52

A solution is calling ssh-add -A command on every startup.

Just add .plist file with the following content to the path ~/Library/LaunchAgents/ or create one with Lingon app:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<key>ProgramArguments</key>
<array>
<string>-A</string>
</array>
<true/>
</dict>
</plist>



Since macOS 10.12.2 you can use the UseKeychain option. Read more here or look into man ssh_config.

     UseKeychain
On macOS, specifies whether the system should search for passphrases in the user's keychain
when attempting to use a particular key. When the passphrase is provided by the user, this
option also specifies whether the passphrase should be stored into the keychain once it has
been verified to be correct.  The argument must be yes'' or no''.  The default is no''.


So just do the following:

echo "UseKeychain yes" >> ~/.ssh/config

• Using >> is at risk if you input the command multiple times. Better do a manual edition of the file, as described by mluisbrown answer or ChrisJF answer. – Cœur Feb 3 '17 at 2:37
• You are right there :-) – Ben Feb 4 '17 at 19:53

I had this problem before and I've found a way to bypass this. I just created a file named config in my ~/.ssh folder, where I've added the following lines:

Host github.com
HostName github.com
IdentityFile ~/.ssh/github
IdentitiesOnly yes


I am not sure why, but Host and HostName both are important. In my case if one of them was not present then the solution didn't work.

Then, I just did an ssh-add -K and it was working even after the restart.

• Host is your user-defined name/alias for a particular server and demarcates entries per server: stylistically it's nice to indent the lines that follow the Host entry. HostName indicates the server's network addressable name like github.com, but you could use an IP address too. Host and HostName don't have to be the same thing, but yes, they are both integral to the ssh config format. – Mark Fox Dec 13 '16 at 0:35

If you are using a different version of ssh (e.g. installed via homebrew) the above solutions will not work out of the box. For instance, AddKeysToAgent yes and UseKeychain yes in the .ssh/config file are not recognized by non-Apple ssh versions and will cause an error. The same for the -A or -K option for the ssh client.

That means @mluisbrown's answer will not work at all. You can use method 1 of @JakeGould's answer and explicitly use the macOS ssh-add utility in your .bash_profile to add all keys to the keychain, i.e.:

/usr/bin/ssh-add -A


As mentioned by a comment above, you may have to add a key to the keychain first: e.g. /usr/bin/ssh-add -K .ssh/github

I found that ssh-add -K gave me "illegal option -- K". This was because ssh-add was a strange version coming from /usr/local/bin (installed by brew?). I was able to add the key by specific use of the ssh-add located in /usr/bin:

/usr/bin/ssh-add -K ~/.ssh/id_rsa

• this is what worked fro me after failing to work easily for ages. – nyxee Oct 4 '19 at 13:35

Amending ~/.ssh/config to add UseKeyChain for all hosts is enough to stop this recurring nightmare ;)

Host *
UseKeychain yes


If the file is empty or doesn't exist simple create and/or add the above configuration.

I updated to Mac OS X Sierra (10.12.6). I could ssh into other hosts but not into github.com.

This is what I had to insert into ~/.ssh/config:

PubkeyAcceptedKeyTypes ssh-dss,ssh-rsa


After that change, I could use github as before.