Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my Macbook, my SSH private key is encrypted, but I never have to re-enter the passphrase even if I reboot the machine.

The system must be unlocking it along with my user account.

Is it possible to set it up the same way for my user account on a CentOS server? There should be some sort of option that would basically encrypt the privatekey with the user account password (or at least encrypt the passphrase with the user password). I do not want the private key in plaintext on the hard disk, and would prefer not to have to enter many passwords.

If the answer is no, then I probably will need to enter it once each time the server is booted. That is less good, but since that should be a rare occurrence, that would be tolerable.

share|improve this question
up vote 1 down vote accepted

You need a keyring or keychain to maintain the ssh-agent auth socket location for you.

On CentOS you can install keychain, see http://www.cyberciti.biz/faq/ssh-passwordless-login-with-keychain-for-scripts/ for a detail guide on how to setup keychain on CentOS.

share|improve this answer
Is there a way to get this to restore the passphrases upon server reboot? (it should be able to do this by encrypting the passphrases with the user login) – Steven Lu Jul 19 '13 at 18:40
@Steven No keychain/keyring program will persist the passwords across reboots, it's not secure. If you are looking for solution to manage your passwords/keys, try LastPass/1Password/etc. and that should never runs on your servers. – number5 Jul 22 '13 at 6:47
I did get it set up and it works nicely. Entering once on reboot is perfectly fine. – Steven Lu Jul 22 '13 at 13:05
Now trying to update my scripts for Centos 7, this does not seem so simple. I don't know why I was okay with installing a repository using a http url to begin with. But this whole keychain business is already a bit of a tin-foil-hat contraption to begin with. I am going to use a well-encrypted private key on machines that need it (and type the pass to unlock that key when it is used there), and generate unencrypted private keys on other general purpose environments. Don't need to have any more impediments than there already are... – Steven Lu Feb 11 '15 at 9:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.