On MacOS 10.12 Sierra (or/and OS X 10.11 EI Capitan) how can one use the passwords for ssh keys stored in the keychain headless?

If one ssh-es in and left a local session running one can see ssh-agent is available

launchctl list | grep ssh
ps ax | grep ssh-agent

and can be used by setting SSH_AUTH_SOCK correctly

SSH_AUTH_SOCK=$(ls -t1 /private/tmp/com.apple.launchd*/Listeners | head -n 1 );

But as soon as the local user logs out the remote session can't use an ssh-agent backed by keychain anymore (no output for the first 2 commands). I tried;

sudo launchctl load /System/Library/LaunchAgents/com.openssh.ssh-agent.plist

but it fails to help, and

eval "$(ssh-agent -l)"

fails with launch_activate_socket(): No such process, and

eval "$(ssh-agent)"

fails to connect to the existing socket /private/tmp/com.apple.launchd.*/Listeners instead using /var/folders/*/*/T/ssh-*/agent.*.

security login-keychain

outputs /Users/*/Library/Keychains/login.keychain-db regardless. It might be possible to trigger a local login but I want to avoid that.

  • Did you already find a solution for that? Apr 2, 2017 at 11:06
  • @AlexanderRemesch locking the screen instead of logout is the only workaround I know of. Apr 3, 2017 at 12:58


You must log in to answer this question.

Browse other questions tagged .