I love ssh -A, which allows me to use my local ssh key when establishing a connection from a remote server. For example, I ssh -A host1.example.com and then from there I can ssh host2.example.com (or use git) and it uses my ssh key from the original machine, which in this case should be my mac. Although this has always worked for me on Debian/Ubuntu, it doesn't work on my new mac (Lion).

What am I missing here? How do I configure ssh to work correctly with -A? Do I need an ssh that is not the standard MacOS one?


Actually, the very simple answer is that you have to run


and then it all works.

Basically, macOS already has the ssh-agent set up for you, but after each reboot you need to add your keys to it. ssh-add gives ssh-agent access to your keys for the current boot cycle. You'll have to enter the password for your private key if you have created one.

  • 1
    That solved my latest ssh forwarding problem after the upgrade to macOS (after 5 years, still a useful answer, thanks @rfay) – 23tux Feb 6 '17 at 11:35
  • This does work, but some explanation of why would be useful/help people remember this command. – Adam Parkin May 29 '18 at 18:52
  • 2
    @AdamParkin added another paragraph explaining. – rfay May 30 '18 at 19:54

As of OS X 10.8 you need to do this once:

sudo touch /var/db/useLS

And add this as part of your ~/.bash_profile:

if [ -f ~/.ssh/id_rsa ]; then
    ssh-add -K ~/.ssh/id_rsa 2>/dev/null

Note: this recipe is parto of my bedouin scripts.

  • Hm, just tried this out; the agent does then start, but you still have to ssh-add to get anything to work. So ssh-add alone is still the answer, as far as I understand. I guess I should add it to my .bash_profile. – rfay Jan 19 '13 at 14:53
  • lol, what if my private key needs a passphrase? – Jeffrey04 Oct 23 '15 at 3:05
  • As shown in this answer, if your key requires a passphrase, the macOS-specific -K option will store your key's passphrase in your Keychain. – beporter Jun 5 '20 at 0:09

The concept behind ssh -A are ssh agents. They run in the background and through the use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh. Have a look at the manpage of ssh-agent for more details.

With Mac OS X, the ssh-agent should be started on demand.

For more information see:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .