Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I set up my ssh stuff with the help of this guide, and it used to work well (I could run hg push without being asked for a passphrase). What could have happened between then and now, considering that I'm still using the same home directory.

$ cat .hg/hgrc 
default = ssh://hg@bitbucket.org/tshepang/bloog

$ hg push
Enter passphrase for key '/home/wena/.ssh/id_rsa': 
pushing to ssh://hg@bitbucket.org/tshepang/bloog
searching for changes
share|improve this question
up vote 64 down vote accepted

You need to use an ssh agent. Short answer: try

$ ssh-add

before pushing. Supply your passphrase when asked.

If you aren't already running an ssh agent you will get the following message:

Could not open a connection to your authentication agent.

In that situation, you can start one and set your environment up thusly

eval $(ssh-agent)

Then repeat the ssh-add command.

It's worth taking a look at the ssh agent manpage.

share|improve this answer

A way to solve this is with ssh-agent and ssh-add:

$ exec ssh-agent bash
$ ssh-add
Enter passphrase for ~/.ssh/id_rsa: 

After this the passphrase is saved for the current session. and won't be asked again.

share|improve this answer

I use Keychain for managing ssh keys. It is also available in Debian and so presumably Ubuntu with

apt-get install keychain

Here is the Debian keychain package page. As you can see, the project is not very active, but works for me. I also commented a bit about this in another answer here

share|improve this answer
Why mention Ubuntu? Did it seem like I'm using it? – Tshepang Apr 29 '11 at 8:29
@Tshepang: It was just for the record. I'm not sure what you currently using. You didn't specify. – Faheem Mitha Apr 29 '11 at 8:46
// , This worked for me. It's way better than ssh-agent, since I do not need to enter my ssh key password every time I open a terminal. – Nathan Basanese Sep 10 '15 at 19:12

For convenience, the optimal method is a combination of the answers of jmtd and Faheem.

Using ssh-agent alone means that a new instance of ssh-agent needs to be created for every new terminal you open. keychain when initialized will ask for the passphrase for the private key(s) and store it. That way your private key is password protected but you won't have to enter your password over and over again.

The Arch wiki recommends initializing keychain from /etc/profile.d/ or your shell profile, such as .bash_profile or .bashrc. This has a disadvantage in that it intializes your keychain as soon as you open a terminal.

A more flexible approach is to combine keychain with a specific tmux session. So, in .bash_profile:

tsess=$(tmux ls 2>&1)

if [[ "${tsess%%:*}" = "secured" ]] && 
   [[ -f $HOME/.keychain/$HOSTNAME-sh ]]; then
    # start keychain
    /usr/bin/keychain -Q -q --nogui ~/.ssh/id_rsa
    . $HOME/.keychain/$HOSTNAME-sh

...and then it is just a case of starting the secured tmux session as and when required (launched from a keybind):

PID=$(pgrep tmux)
new="tmux -f $HOME/.tmux/conf new -s secured"
old="tmux attach -t secured -d"

if [[ -z "$SSH_AUTH_SOCK" ]]; then
    eval `ssh-agent`
    trap "kill $SSH_AGENT_PID" 0

if [[ -z "$PID" ]]; then
    urxvtc -title "SSH" -e sh -c "${new}"
    urxvtc -title "SSH" -e sh -c "${old}"


Now, your keychain will only be initialized once when you start that specific tmux session. As long as that session persists, you will be able to access those ssh keys and push to your remote repositories.

share|improve this answer
How would I get this to work on a remote machine? I modified the second script to check for $SSH_CLIENT and if it exists don't execute urxvtc, just tmux. That works, but the problem is the .bash_profile portion. When I first login to the box it says "server not found: Connection refused" which is the output of "tmux ls". Then, when I execute the second script, tmux either starts a new session or attaches to an existing one, but there is no keychain prompt. Then, when I exit the session, the keychain prompt is there waiting. – jonyamo Feb 20 '12 at 15:13
I've updated the answer to silence tmux output if there is no session. – jasonwryan Feb 20 '12 at 18:08
Thank you, but that still didn't solve the issue with keychain. tmux creates the new session but goes straight to any empty prompt. Only when I exit from the tmux session do I see the keychain prompt asking for my passphrase. – jonyamo Feb 20 '12 at 20:08
I guess I should stop saying keychain, since keychain is only executed in .bash_profile. The issue is from executing ssh-add. Although, if I run ssh-add manually after creating the tmux session, it works. – jonyamo Feb 20 '12 at 20:17
Skip the second script and just start your secured tmux session from .profile - that way you'll get the prompt for keys as soon as you login. – jasonwryan Feb 20 '12 at 20:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.