It seems that
ssh-add -K ~/.ssh/id_rsa will load your key but will ask for the password each time you reboot.
I am looking for a solution that would not require me to re-enter the key password between logins.
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.Visit Stack Exchange
Ask Different is a question and answer site for power users of Apple hardware and software. It only takes a minute to sign up.Sign up to join this community
It is not possible to add private key to Keychain, but you can store passphrase for private key in Keychain.
On OSX, the native
ssh-add command has a special argument to save the private key's passphrase in the OSX Keychain, which means that your normal login will unlock it for use with ssh. On OSX Sierra and later, you also need to configure SSH to always use the Keychain (see Step 2 below).
Alternatively you can use a key without a passphrase, but if you prefer the security that's certainly acceptable with this workflow.
In the latest version of MacOS (12.0 Monterey), just do this once:
ssh-add --apple-use-keychain ~/.ssh/[your-private-key]
Or in versions of MacOS older than 12.0 Monterey, use:
ssh-add -K ~/.ssh/[your-private-key]
Enter your key passphrase, and you won't be asked for it again.
(If this fails, make sure you are using Apple's version of
/usr/bin/ssh-add and not something installed with brew etc.; check with
(Note: In versions of OSX prior to Sierra, this is not necessary)
It seems that OSX Sierra removed the convenient behavior of persisting your keys between logins, and the update to ssh no longer uses the keychain by default. Because of this, you need to change one more thing for secure persistent key storage.
The solution is outlined in this github thread comment. Here's what you do:
Ensure you've completed Step 1 above to store the passphrase in the keychain.
If you haven't already, create an
~/.ssh/config file. In other words, in the
.ssh directory in your home dir, make a file called
.ssh/config file, add the following lines:
Host * UseKeychain yes AddKeysToAgent yes IdentityFile ~/.ssh/id_rsa
~/.ssh/id_rsa to the actual filename of your private key. If you have other private keys in your
~/.ssh directory, also add an
IdentityFile line for each of them. For example, I have one additional line that reads
IdentityFile ~/.ssh/id_ed25519 for a 2nd private key.
UseKeychain yes is the key part, which tells SSH to look in your OSX keychain for the key passphrase.
That's it! Next time you load any ssh connection, it will try the private keys you've specified, and it will look for their passphrase in the OSX keychain. No passphrase typing required.
ssh-add -Amanually to load your saved keychain. Some possible solutions referenced above.
.ssh/configfile looks promising! See github.com/lionheart/openradar-mirror/issues/…
Aflag in addition to the
Kone to add my keys to the keychain and register the passphrase into it (
ssh-add -AK ~/.ssh/[your-private-key]). Thanks!
I had a similar problem, in that I was being asked every time for my pub-key passphrase. Per suggestion of user "trisweb" above, I turned on these options to
Host * UseKeychain yes AddKeysToAgent yes IdentityFile ~/.ssh/id_rsa
But it still prompted every time I wanted to use ssh. Eventually I turned on
ssh -v and found this debug line:
debug1: key_load_private: incorrect passphrase supplied to decrypt private key
I then opened my keychain in "Keychain Access.app", found the key named "SSH: /Users/username/.ssh/id_rsa" and opened it up. I clicked "Show password" to disclose the password and indeed found that the passphrase in the keyring was an old passphrase. I updated the passphrase in Keychain Access, and now password-free works.
I could have also updated the passphrase with this phrase:
ssh-keygen -p -f ~/.ssh/id_rsa
To all where the above did not work, my issue appears to have been because I was duplicating the
UseKeychain yes &
AddKeysToAgent yes in all ssh key profiles / shortcuts. I updated my
~/.ssh/config file to declare these only once and they now all load on login without prompting for passwords on startup, e.g:
Host foo HostName foo.com User fooUser IdentityFile ~/.ssh/foo Host bar HostName bar.com User barUser IdentityFile ~/.ssh/bar ######################## # Keep the default configuration # as the last item in this file Host * UseKeychain yes AddKeysToAgent yes IdentityFile ~/.ssh/foo IdentityFile ~/.ssh/bar
Host *be after specific host rules. See
man ssh_configfor details. Mar 31, 2020 at 4:31
IdentityFile ~/.ssh/foowas always used. To fix, I had to move the Host * section to the bottom, as @FranklinYu suggests. I think this is because > For each parameter, the first obtained value will be used. linux.die.net/man/5/ssh_config Jun 18, 2021 at 3:34
Also, in macOS Sierra and High Sierra (don't know about previous versions), running
ssh-add -A will get the agent to load all keys whose passphrases are stored on Keychain... So very handy
Note that these option flags have been renamed and the old ones deprecated in later versions of macOS. From the
ssh man page:
Enables or disables the older processing of the
-Koptions used in earlier macOS releases. These options have been renamed
-Kstill behave as in earlier releases except in the following circumstances:
- If a security provider was specified with
-Sor SSH_SK_PROVIDER, or if APPLE_SSH_ADD_BEHAVIOR is set to the value “openssh”, then
ssh-adduses standard OpenSSH behavior: the
-Aflag is not recognized and the
-Kflag behaves as documented in the DESCRIPTION section above.
-Kwill behave as in earlier macOS releases. A warning will be output to standard error unless APPLE_SSH_ADD_BEHAVIOR is set to the value “macos”. Note: Future releases of macOS will not support neither
-Kwithout setting this environment variable.
You can now use the flag
--apple-use-keychain to accomplish exactly this.
ssh-add --apple-use-keychain ~/.ssh/id_rsa
Add this to your
.bashrc file to have it load from your keychain on new logins / terminal instances.
This replaces the
WARNING: The -K and -A flags are deprecated and have been replaced by the --apple-use-keychain and --apple-load-keychain flags, respectively. To suppress this warning, set the environment variable APPLE_SSH_ADD_BEHAVIOR as described in the ssh-add(1) manual page.
ssh-add --apple-load-keychain -qto my
.zshrcfile. Nov 8, 2022 at 22:00
One of solutions is to delete .ssh from path. Like this - "ssh-add --apple-use-keychain ~/id_ed25519" or "ssh-add --apple-use-keychain ~/[YOURS ID OF SSH]"
Also you need to change path in ~/.ssh/config by deleting /.ssh
Add the public key in:
Public key usually are on:
Hope that helps
authorized_keysMay 23, 2012 at 18:47
id_rsakey has a password on it.
ssh-add, but just run
sshdirectly. You should get a window popping up that will as the pass phrase for the key, and with a checkbox to let you store it in your keychain.