It seems that ssh-add -K ~/.ssh/id_rsa will load your key but will ask for the password each time you reboot.

I am looking for a solution that would not require me to re-enter the key password between logins.

  • 1
    Can you say a little more about when the password prompt comes up for you? I ask because I have an ssh-key for a remote server, which I assure you is not the same as my Mac login password or anything, and I haven't had to enter the password for the ssh-key for years. I can just open up a terminal, type "ssh <server>", and I'm there. I think I first set this key up under OSX 10.5. id_dsa, but I don't think that should matter. – Michael H. Apr 13 '12 at 16:39
  • My id_rsa key has a password on it. – sorin Apr 13 '12 at 16:46
  • I also have the problem that I solved this so long ago that I can't remember exactly what I did. But I think the idea is to not run ssh-add, but just run ssh directly. You should get a window popping up that will as the pass phrase for the key, and with a checkbox to let you store it in your keychain. – Harald Hanche-Olsen Apr 13 '12 at 18:19
  • 1
    @Sorin - so does mine! I had to enter it once, long ago, and the Mac has saved it for me ever since. Hopefully Harald's advice will help. – Michael H. Apr 13 '12 at 18:35
  • Do you mean the Keychain password (i.e. your login password) or the key's passphrase? If it's the latter, re your passphrases definitely stored in Keychain? You can check this by opening Keychain Access and looking for it in the login keychain. – Mathew Hall Apr 20 '12 at 11:41
up vote 520 down vote accepted

On OSX, the native ssh-add client has a special argument to save the private key's passphrase in the OSX keychain, which means that your normal login will unlock it for use with ssh. On OSX Sierra and later, you also need to configure SSH to always use the keychain (see Step 2 below).

Alternatively you can use a key without a passphrase, but if you prefer the security that's certainly acceptable with this workflow.

Step 1 - Store the key in the keychain

Just do this once:

ssh-add -K ~/.ssh/[your-private-key]

Enter your key passphrase, and you won't be asked for it again.

(If you're on a pre-Sierra version of OSX, you're done, Step 2 is not required.)

Step 2 - Configure SSH to always use the keychain

It seems that OSX Sierra removed the convenient behavior of persisting your keys between logins, and the update to ssh no longer uses the keychain by default. Because of this, you will get prompted to enter the passphrase for a key after you upgrade, and again after each restart.

The solution is fairly simple, and is outlined in this github thread comment. Here's how you set it up:

  1. Ensure you've completed Step 1 above to store the key in the keychain.

  2. If you haven't already, create an ~/.ssh/config file. In other words, in the .ssh directory in your home dir, make a file called config.

  3. In that .ssh/config file, add the following lines:

    Host *
      UseKeychain yes
      AddKeysToAgent yes
      IdentityFile ~/.ssh/id_rsa
    

    Change ~/.ssh/id_rsa to the actual filename of your private key. If you have other private keys in your ~.ssh directory, also add an IdentityFile line for each of them. For example, I have one additional line that reads IdentityFile ~/.ssh/id_ed25519 for a 2nd private key.

    The UseKeychain yes is the key part, which tells SSH to look in your OSX keychain for the key passphrase.

  4. That's it! Next time you load any ssh connection, it will try the private keys you've specified, and it will look for their passphrase in the OSX keychain. No passphrase typing required.

  • 2
    This almost worked for me. My "login" keychain already had automatic locking disabled, so Matthew Sanabria's answer did not apply. Using ssh-add -K ... added the keys to the ssh agent without prompting for a password, but only for the current session. After a reboot, I had to reissue the command. – Poulsbo Dec 16 '16 at 7:08
  • 3
    @Poulsbo & @Abram -- see my update, Sierra changed the automatic behavior and now you have to run ssh-add -A manually to load your saved keychain. Some possible solutions referenced above. – trisweb Jan 3 '17 at 22:20
  • 3
    @trisweb Thanks for the tip. joshbuchea's solution of modifying the .ssh/config file looks promising! See github.com/lionheart/openradar-mirror/issues/… – Poulsbo Jan 6 '17 at 21:19
  • 2
    @sorin see the updated answer, and let me know if you have any feedback. Thanks! – trisweb Jan 11 '17 at 19:53
  • 7
    Works great! In my case I needed to use the A flag in addition to the K one to add my keys to the keychain and register the passphrase into it (ssh-add -AK ~/.ssh/[your-private-key]). Thanks! – youssman Mar 7 '17 at 22:28

You are being prompted for the password every time because your "login" keychain is being locked after inactivity and/or sleeping or in your case a reboot. There are two ways to solve this for you.

  1. Change the settings for your "login" keychain. Assuming your ssh key is stored in the "login" keychain.

    • Open Keychain Access
    • Highlight the "login" keychain
    • Right-click or option-click the "login" keychain
    • Uncheck the "Lock after X minutes of inactivity" and the "Lock when sleeping" checkboxes.
  2. Generate another SSH key without using a passphrase.

    • Open Terminal.
    • Enter command: ssh-keygen -t rsa -b 4096 -C <comment> -f <.ssh/id_rsa>
    • -t is for type, -b is key size, -C is comment, -f output file (must create directories first)
    • Do not set a passphrase.
    • Import SSH key into "login" keychain with ssh-add -K <path to ssh key>

You should not be prompted for a keychain password anymore.

  • 1
    Note that when invoking ssh-add from inside SSH, security unlock-keychain must be called first. Also, I didn't have to create the directories for the -f parameter. Unfortunately, I still had to call security unlocl-keychain in SSH sessions in order to access the login Keychain, which prompts for password every time... – Ohad Schneider Dec 27 '16 at 13:19
  • 1
    The whole point is to have a passphrase on the key. I doubt that generating a new SSH key is helpful to the question. – Gray Jan 20 at 16:36

I had a similar problem, in that I was being asked EVERY TIME for my pub-key passphrase.

Per suggestion of user "trisweb" above, I turned on these options to ~/.ssh/config:

Host *
  UseKeychain yes
  AddKeysToAgent yes
  IdentityFile ~/.ssh/id_rsa

BUT it still prompted every time I wanted to use ssh.

Eventually I turned on "ssh -v" and found this debug line:

debug1: key_load_private: incorrect passphrase supplied to decrypt private key

I then opened my keychain in "Keychain Access.app", found the key named "SSH: /Users/username/.ssh/id_rsa" and opened it up.

I clicked "Show password" to disclose the password and indeed found that the passphrase in the keyring was an old passphrase.

I updated the passphrase in Keychain Access, and now password-free works.

I could have also updated the passphrase with this phrase:

ssh-keygen -p -f ~/.ssh/id_rsa

Also, in macOS Sierra and HighSierra (don't know about previous versions), running ssh-add -A will get the agent to load all keys whose passphrases are stored on Keychain... So very handy

To all where the above did not work, my issue appears to have been because I was duplicating the UseKeychain yes & AddKeysToAgent yes in all ssh key profiles / shortcuts. I updated my ~/.ssh/config file to declare these only once and they now all load on login without prompting for passwords on startup, e.g:

Host *
  UseKeychain yes
  AddKeysToAgent yes
  IdentityFile ~/.ssh/foo
  IdentityFile ~/.ssh/bar

Host foo
  HostName foo.com
  User fooUser
  IdentityFile ~/.ssh/foo

Host bar
  HostName bar.com
  User barUser
  IdentityFile ~/.ssh/bar

Add the public key in:

.ssh/known_hosts

Public key usually are on:

/home/user/.ssh/id_rsa.pub

Hope that helps

  • 6
    I think mean the authorized_keys – Rene Larsen May 23 '12 at 18:47
  • Anyway, this doesn't work if you have more than one key! – sorin May 24 '12 at 10:01

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.