2

I've installed OpenSSH using homebrew (brew install openssh) and this installation provides it's own ssh-agent.

Still, when I login, and see the autostarted ssh-agent, I see that the agent that is started is the OS X agent, and not the one installed via Homebrew OpenSSH.

Also, how do I start the ssh-agent from openssh by default every time that I login? Finally, is there any way in which I can automatically load key files to the openssh agent, and have these key files loaded the next time that I login as well?

1

ssh-agent, the system builtin one, is run as a system daemon started by /System/Library/LaunchAgents/com.openssh.ssh-agent.plist. Cause the service plist is located in /System/Library/LaunchAgents, it mean it's impossible to disable it unless you break SIP, which is not recommended.

The macOS version ssh-agent is built with additional KeyChain support compared with the standard one. The best solution is to use the keychain.

First, uninstall the homebrew-installed SSH, brew uninstall openssh.

Secondly, configure the SSH to use password from Keychain.

Host *
AddKeysToAgent yes
# use the password stored in keychain
UseKeychain yes
IdentityFile ~/.ssh/id_rsa

Thirdly, add the key and password into Keychain.

ssh-add -K ~/.ssh/id_rsa

In this solution, we keep the password into Keychain and configure OpenSSH to load password for the key from Keychain.

References

  • 1
    Since you've recommended uninstalling openssh, note that you aren't using openssh, but rather the macos version of ssh. Which is like openssh but is either missing some connection options of openssh or has different names for these options. What I did realize though, was that openssh works well with the macos ssh-agent. So that's what I am using now. – kapad Sep 12 at 5:16
  • FYI, you cannot have a comment at the end of a line in ~/.ssh/config: UseKeychain yes # use the password stored in keychain. You will get the error message garbage at end of line; "#" – wisbucky Sep 18 at 0:23
  • @wisbucky Thx. I forgot that ssh config doesn't support inline comment. – Simba Sep 18 at 3:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .