Hot answers tagged

883

On OSX, the native ssh-add client has a special argument to save the private key's passphrase in the OSX keychain, which means that your normal login will unlock it for use with ssh. On OSX Sierra and later, you also need to configure SSH to always use the keychain (see Step 2 below). Alternatively you can use a key without a passphrase, but if you prefer ...


239

As of macOS Sierra 10.12.2 Apple added an ssh_config option called UseKeychain which allows a 'proper' resolution to the problem. Add the following to your ~/.ssh/config file: Host * AddKeysToAgent yes UseKeychain yes From the ssh_config man page on 10.12.2: UseKeychain On macOS, specifies whether the system should search for passphrases in the ...


115

I had this issue as well when attempting to deploy some code using Capistrano. Very frustrating. Here are two methods I know of to deal with this issue. Method 1: Add all known keys to the SSH agent. So one solution I found is to run ssh-add with the -A option—which adds all known identities to the SSH agent using any passphrases stored in your keychain—...


104

The best solution I've found today (2017) is to use Homebrew and Cask to install osxfuse and sshfs: brew cask install osxfuse brew install sshfs And then: sshfs username@hostname:/remote/directory/path /local/mount/point -ovolname=NAME It works! :-)


91

First, run ssh-add -K and check whether this fixes your problem. If not: Removed the rsa_id.pub file and regenerated a new one (must be in ~/.ssh/): ssh-keygen -y -f id_rsa > id_rsa.pub Ensured permissions were set to 600 for both id_rsa and id_rsa.pub (must be in ~/.ssh/): chmod 600 id_rsa* Ran the following command: ssh-add -K After doing this, ...


86

You should be using SSH keys to authenticate with rather than putting your password on the command line as it's extremely insecure. The way this works is once you have your SSH keys set up, all you have to do is issue the command: ssh user@host and without typing another thing, you will be automatically logged in. Copy SSH Public Key to Mac/FreeBSD/Linux ...


53

Why not just use an SSH Tunnel via OSX's built in Terminal?... Launch an SSH tunnel To initiate your SSH tunnel, simply open Mac OSX Terminal.app and connect to your remote server via SSH with the following flags: ssh -D 8080 -C -N username@example.com This will launch our SSH tunnel on port 8080 and route all traffic (securely) through the server at ...


45

You can enable bash shell completion by installing bash-completion via brew: brew install bash-completion Then add the following to your ~/.bash_profile: if [ -f $(brew --prefix)/etc/bash_completion ]; then . $(brew --prefix)/etc/bash_completion fi Source (Edit: brew tap homebrew/completions is deprecated as of 2018.)


41

In the find file window, press Command-Shift-G. It'll ask you what folder to navigate to. Enter ~/.ssh and press return.


36

Here is a different way that enables screen sharing access all current users, instead of using a single vnc password; sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resouces/kickstart \ -activate -configure -access -on \ -configure -allowAccessFor -allUsers \ -configure -restart -agent -privs -all Disable with this: sudo /System/...


31

You can: Configure your system, system-wide, for all connections By editing: /etc/ssh/ssh_config And add the line: ServerAliveInterval 10 Or, per-server ~/.ssh/config Host keepsdroppingme.com ServerAliveInterval 10 What this basically does it sends keep alive packet, every 10 seconds...


31

PuTTY is a great Windows frontend, not to mention the need for an SSH client in the first place. On Linux, OS X, and most other UNIX-y based environments, SSH is generally purely command line, but still amazingly powerful. The SSH client allows you to store an amazing amount of properties based on a given hostname, even global defaults, in the "ssh_config" ...


28

I had a similar problem, in that I was being asked every time for my pub-key passphrase. Per suggestion of user "trisweb" above, I turned on these options to ~/.ssh/config: Host * UseKeychain yes AddKeysToAgent yes IdentityFile ~/.ssh/id_rsa But it still prompted every time I wanted to use ssh. Eventually I turned on ssh -v and found this debug line: ...


27

Welcome to the wonderful world of OS X Keychain and ssh-agent! From the man page: ssh-agent is a program to hold private keys used for public key authentication (RSA, DSA, ECDSA). The idea is that ssh-agent is started in the beginning of an X-session or a login session, and all other windows or programs are started as clients to the ssh-...


27

To disable storing passphrase in keychain you should add following lines to ~/.ssh/config file: Host * UseKeyChain no If you already have passphrase stored in keychain you can delete it using commands: cd ~/Library/Keychains/<UUID>/ sqlite3 keychain-2.db 'delete from genp where agrp="com.apple.ssh.passphrases"' If you would like to have a behavior ...


24

The best GUI application for SSH (and everything else you can do on the command line) is iTerm 2. While the original iTerm had a tabbed interface before Terminal did, iTerm 2 again eclipses Terminal by adding: Support for 256 colors (you'll never go back to 16 colors after using 256) Split panes (the sort of thing you can do in GNU screen or tmux, but at ...


23

Has Apple locked this file [/System/Library/LaunchDaemons/ssh.plist] down definitively? Yes, they have, you need to disable SIP (System Integrity Protection), but note that editing ssh.plist is not the only option to change the SSH server port, there are other ways to achieve the same result. There are (at least) 4 ways to change the port sshd listens on: ...


22

Add a PROMPT_COMMAND to your .bash_profile export PROMPT_COMMAND="echo -ne '\033]0;${USER}@${HOSTNAME}\007';$PROMPT_COMMAND" The PROMPT_COMMAND gets executed every time the prompt is displayed. Please note that we include the existing PROMPT_COMMAND environment variable, such that we do not lose any existing settings (i.e. update_terminal_cwd).


22

Apparently, the private key I was using on my machine was an old one. My key did not contain the encryption information added to the private key file if I generate a new one: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-... To solve the problem, I decrypted the key with openssl: $ cd ~/.ssh $ cp id_rsa id_rsa.bck $ openssl rsa -in ...


22

The dialog for ssh-agent can be circumvented by adding the key in the console/terminal: ssh-add ~/.ssh/id_rsa. You can then paste the password into the terminal. Also, adding the -K option to ssh-add will save it to the keychain as per Oliver Lacans comment. As mattmcmanus said, id_rsa encryption using PKCS seems to be broken on OSX Mavericks ssh-agent. The ...


20

Try Secure Pipes: http://www.opoet.com It's free software and I'm looking to get more people using it.


20

In my case ssh-add -K didn't do the trick, I had to specify the key: ssh-add ~/.ssh/id_rsa


20

UPDATE Developer Jeremy Huddleston Sequoia announced yesterday that this problem is solved in XQuartz 2.7.8_beta2: XQuartz 2.7.8_beta2 is available for download. You can see http://xquartz.macosforge.org/trac/wiki/X112.7.8 for a full set of changes, but most noteworth ones are: 1) xauth now correctly parses the Yosemite launchd $DISPLAY ...


20

Thanks to Clive, I have a better understanding of this new 'feature'. When you type in your passphrase Sierra adds it to your Keychain but not to the ssh-agent. If your identity isn't in ssh-agent there is no way to manage it with ssh-add. To manage (ie. remove) your identity from Keychain you need to add your identity to ssh-agent by using ssh-add. Once you ...


20

The issue is ssh is waiting for a connection to your ssh-agent. You can test this by running SSH_AUTH_SOCK= ssh git@github.com. If this is indeed the issue (as it was for me), then you probably have multiple LaunchAgents that are listening on the socket at SSH_AUTH_SOCK and one of them is doing the wrong thing. For example, I had one from MacPorts that was ...


19

To disable strict host checking on OS X for the current user, create or edit ~/.ssh/config and add the following lines: Host [IP Address] StrictHostKeyChecking no UserKnownHostsFile=/dev/null A typical example for the hosts in your local network could be: Host 10.1.1.* StrictHostKeyChecking no UserKnownHostsFile=/dev/null Depending on your ...


18

As explained here, this is the recommended method since macOS 10.12.2: Add the following lines to your ~/.ssh/config file: Host * UseKeychain yes AddKeysToAgent yes Any key you add to the ssh-agent using the ssh-add /path/to/your/private/key/id_rsa command will be automatically added to the keychain, and should be autoloaded upon reboot. I'm ...


18

Update: One option is add your private SSH key to macOS Keychain, then use TouchID for Keychain authentication. You will want to use ssh-add -K ~/.ssh/[your-private-key] -- however on macOS 10.12 Sierra the feature needs to be enabled by editing editing ~/.ssh/config and adding: Host * (asterisk for all hosts or add specific host) AddKeysToAgent yes ...


17

For macOS 10.12 Sierra ssh-add -K needs to be run after every reboot. To avoid this create ~/.ssh/config with this content. Host * AddKeysToAgent yes UseKeychain yes IdentityFile ~/.ssh/id_rsa Apple has added Technote 2449 which explains what happened. Prior to macOS Sierra, ssh would present a dialog asking for your passphrase and would offer ...


17

The manpage describes the ability to generate ECC keys because the version of OpenSSH 5.9p1 (the version that comes with Mountain Lion) can potentially support ECC. However, the actual build of OpenSSH that came bundled with Mountain Lion appears to lack ECC support1. The manpages are not modified when ECC support is not included in the compiled binaries. ...


Only top voted, non community-wiki answers of a minimum length are eligible