I set up my ssh stuff with the help of this guide, and it used to work well (I could run hg push without being asked for a passphrase). What could have happened between then and now, considering that I'm still using the same home directory.

$ cat .hg/hgrc 
default = ssh://hg@bitbucket.org/tshepang/bloog

$ hg push
Enter passphrase for key '/home/wena/.ssh/id_rsa': 
pushing to ssh://hg@bitbucket.org/tshepang/bloog
searching for changes

You need to use an ssh agent. Short answer: try

$ ssh-add

before pushing. Supply your passphrase when asked.

If you aren't already running an ssh agent you will get the following message:

Could not open a connection to your authentication agent.

In that situation, you can start one and set your environment up thusly

eval $(ssh-agent)

Then repeat the ssh-add command.

It's worth taking a look at the ssh agent manpage.

  • 2
    What is the point of the eval could you just type ssh-agent? – James McMahon Sep 18 '17 at 17:07
  • 3
    It displays some commands that allow you to use it, and doesn't execute them for you; eval does the excuting. – Tshepang Feb 3 '18 at 9:21
  • Not related to the original question but if you keep having these issues on GitHub, Bitbucket etc, make sure you're using the git/ssh URL, not the http, which will keep asking for username+password. – Czechnology Jun 11 '18 at 7:18

A way to solve this is with ssh-agent and ssh-add:

$ exec ssh-agent bash
$ ssh-add
Enter passphrase for ~/.ssh/id_rsa: 

After this the passphrase is saved for the current session. and won't be asked again.

  • 3
    Most people don't want to be bugged for their pass phrases at all. – connexo Jun 16 '18 at 16:55

I use Keychain for managing ssh keys. It is also available in Debian and so presumably Ubuntu with

apt-get install keychain

Here is the Debian keychain package page. As you can see, the project is not very active, but works for me. I also commented a bit about this in another answer here

  • 2
    // , This worked for me. It's way better than ssh-agent, since I do not need to enter my ssh key password every time I open a terminal. – Nathan Basanese Sep 10 '15 at 19:12
  • @NathanBasane are you saying that using keychain you don't need to enter the ssh key password every time you open a terminal? How do you configure that? because keychain keeps asking for the password every time I open the terminal, only the first time I open it after booting though, but still. I don't want to enter the passphrase every time. – m4l490n Jan 1 '18 at 19:20
  • @m4l490n No, if you are using keychain, you should not need to enter the ssh key password every time you open a terminal. But you do need to enter it once after booting. The passphrase isn't saved to disk - that would insecure. – Faheem Mitha Jan 1 '18 at 20:27

Create (or edit if it exists) the following ~/.ssh/config file:

Host *
    UseKeychain yes
    AddKeysToAgent yes
    IdentityFile ~/.ssh/id_rsa
  • But I'm using a different pair of keys for every service... – connexo Jun 16 '18 at 16:53
  • @connexo you can replace the wildcard asterisk with your individual host name and 'id_rsa' with your corresponding private key – ness-EE Jun 25 '18 at 13:26
  • 1
    I needed to add IgnoreUnknown AddKeysToAgent,UseKeychain just above UseKeychain yes. – consideRatio Jul 22 '18 at 23:36
  • I'm getting this error: "Bad configuration option: usekeychain" on the "UseKeychain yes" line. – m4l490n Oct 31 '18 at 15:09
  • @m4l490n: it seems that the UseKeychain option was added in OpenSSH 7.1p2 (2016-02-28). Maybe you have a previous version. openssh.com/txt/release-7.2 – chus Nov 15 '18 at 11:43

For convenience, the optimal method is a combination of the answers of jmtd and Faheem.

Using ssh-agent alone means that a new instance of ssh-agent needs to be created for every new terminal you open. keychain when initialized will ask for the passphrase for the private key(s) and store it. That way your private key is password protected but you won't have to enter your password over and over again.

The Arch wiki recommends initializing keychain from /etc/profile.d/ or your shell profile, such as .bash_profile or .bashrc. This has a disadvantage in that it intializes your keychain as soon as you open a terminal.

A more flexible approach is to combine keychain with a specific tmux session. So, in .bash_profile:

tsess=$(tmux ls 2>&1)

if [[ "${tsess%%:*}" = "secured" ]] && 
   [[ -f $HOME/.keychain/$HOSTNAME-sh ]]; then
    # start keychain
    /usr/bin/keychain -Q -q --nogui ~/.ssh/id_rsa
    . $HOME/.keychain/$HOSTNAME-sh

...and then it is just a case of starting the secured tmux session as and when required (launched from a keybind):

PID=$(pgrep tmux)
new="tmux -f $HOME/.tmux/conf new -s secured"
old="tmux attach -t secured -d"

if [[ -z "$SSH_AUTH_SOCK" ]]; then
    eval `ssh-agent`
    trap "kill $SSH_AGENT_PID" 0

if [[ -z "$PID" ]]; then
    urxvtc -title "SSH" -e sh -c "${new}"
    urxvtc -title "SSH" -e sh -c "${old}"


Now, your keychain will only be initialized once when you start that specific tmux session. As long as that session persists, you will be able to access those ssh keys and push to your remote repositories.

  • How would I get this to work on a remote machine? I modified the second script to check for $SSH_CLIENT and if it exists don't execute urxvtc, just tmux. That works, but the problem is the .bash_profile portion. When I first login to the box it says "server not found: Connection refused" which is the output of "tmux ls". Then, when I execute the second script, tmux either starts a new session or attaches to an existing one, but there is no keychain prompt. Then, when I exit the session, the keychain prompt is there waiting. – jonyamo Feb 20 '12 at 15:13
  • I've updated the answer to silence tmux output if there is no session. – jasonwryan Feb 20 '12 at 18:08
  • Thank you, but that still didn't solve the issue with keychain. tmux creates the new session but goes straight to any empty prompt. Only when I exit from the tmux session do I see the keychain prompt asking for my passphrase. – jonyamo Feb 20 '12 at 20:08
  • I guess I should stop saying keychain, since keychain is only executed in .bash_profile. The issue is from executing ssh-add. Although, if I run ssh-add manually after creating the tmux session, it works. – jonyamo Feb 20 '12 at 20:17
  • 1
    Skip the second script and just start your secured tmux session from .profile - that way you'll get the prompt for keys as soon as you login. – jasonwryan Feb 20 '12 at 20:29

You can use sshpass:

$ sudo apt-get install sshpass
$ sshpass -p 'password' ssh username@server

You just need to add sshpass -p yourpassphrase before appending your usual ssh command.

  • 1
    That sounds like a really stupid idea. Wouldn't that make your password show up in clear text in your shell history? – connexo Jun 16 '18 at 16:54
  • Exactly, but are you not supposed to protect your session with a password as well? – belka Jun 18 '18 at 8:01
  • Even if you do, how often do you have a colleague sitting next to you and helping you/learning from you? – connexo Jun 18 '18 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.