ssh -A stopped working in macOS Sierra and keychain is not unlocked at login

Question

After upgrading, ssh -A no longer works. Uncomment ForwardAgent no line the /etc/ssh/ssh_config and change no to yes does not seems to work. This is extremely annoying. In addition, my Mac is password protected.

Previously, after I login, I never needed to enter the password for ssh once I selected something like "unlock keychain for ssh on login", years ago. I don't remember the exact message. I only needed to do it once for every mac I ever owned. However, it now prompts for password when I need to access ssh id_rsa, such as using git. I deleted the login item in the keychain, and the next time I restarted, try to use ssh, the password prompts appears again, but no prompt asking me if I want the keychain to remember and unlock the key.

Can anyone help or at least explain what changes are made for ssh in the new OS.

Edit To answer my own question, ssh-add -K seems to do the trick.

Answer 1

It seems that the ssh keys are not loaded by default into ssh-agent.

This solved the issue for me:

Edit your ssh config

vi ~/.ssh/config

Add the following

Host *
    IdentityFile ~/.ssh/id_rsa
    AddKeysToAgent yes
    ForwardAgent yes

Find out more information on reddit discussion: https://www.reddit.com/r/osx/comments/52zn5r/difficulties_with_sshagent_in_macos_sierra/

Answer 2

The answer above works for RSA Keys, but once I had a DSA key, the solution had an additional step. Add the key using

ssh-add -K ~/.ssh/id_dsa

Then, edit or create the file ~/.ssh/config with the following content:

IdentityFile ~/.ssh/id_dsa
PubkeyAcceptedKeyTypes=+ssh-dss

After saving this file it should work.

Answer 3

Sierra is now using OpenSSH 7.0 which has deprecated DSA keys.

If you need to use DSA keys still, add the following to the top of your ~/.ssh/config

Host *
    PubkeyAcceptedKeyTypes ssh-dss*