As described in many other posts, after upgrading to MacOS Sierra I modified the ssh config file like so:

Host me
HostName login.hpc.ugent.be
User vscxxxxx
Port 22

Host *
  AddKeysToAgent yes
  UseKeychain yes

Still I get the following error:

$ssh -Y [email protected]
/Users/manfredo/.ssh/config: line 8: Bad configuration option: usekeychain
/Users/manfredo/.ssh/config: terminating, 1 bad configuration options

What am I missing?

  • What is the output of ssh -V and type ssh? Or do you know whether you have non-system-default ssh installed? Commented Mar 1, 2017 at 17:31
  • OpenSSH_7.3p1, OpenSSL 1.0.2k 26 Jan 2017
    – Manfredo
    Commented Mar 1, 2017 at 17:52
  • BTW, the config file shown above seems to have incorrect indentation. Was this intentional?
    – David J.
    Commented Jun 16, 2021 at 19:16

3 Answers 3


Just remove the UseKeychain yes line from your configuration. The update broke existing setup by removing this option.

  • This is probably false, assuming we are talking the system-provided ssh. What update broke it? Or do you mean some non-Apple ssh update? I'm on up-to-date macOS and having UseKeychain yes or usekeychain yes give no errors. Commented Mar 1, 2017 at 17:32
  • That actually works. I don't really know what caused it to stop working, the only thing is I updated my macport packages today.
    – Manfredo
    Commented Mar 1, 2017 at 17:53
  • This answer removes useful functionality, use the other answers which actually work.
    – HappyFace
    Commented Sep 8, 2023 at 9:39

Apple's documentation on OpenSSH updates in macOS 10.12.2 states that:

If you are sharing your ssh configuration with systems running older versions of OpenSSH that don't understand the UseKeychain option, you can specify the IgnoreUnknown option to keep your configuration compatible with both new and old versions.

So the trick is that in your ssh config file, add IgnoreUnknown UseKeychain like below:

Host *
  AddKeysToAgent yes
  IgnoreUnknown UseKeychain
  UseKeychain yes
  • This worked for me but only for the first directive, still got "Bad configuration option: usekeychain" even though I added the "IgnoreUnknown Usekeychain" in all 3 it's used in. ¯_(ツ)_/¯ Commented Sep 7, 2022 at 15:26

If you specify /usr/bin/ssh for the commands, it works. The default path in 10.12 puts /usr/local/bin at the top so any other version of ssh will not work with that option, since it's specific to the mac system.

  • to add on to this, simply nano ~/.bash_profile then make sure /usr/bin is before /usr/local/bin if they aren't in your $PATH declaration at all simply add both with them in that order. Something like export PATH="~/bin:/usr/bin:/usr/local/bin/:$PATH then source ~/.bash_profile this resolved it for me
    – abc123
    Commented May 30, 2017 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .