The addition of keys to the agent is transient. They last only so long as the agent is running. If you kill it or restart your computer they're lost until you re-add them again. From the
ssh-agent man page:
ssh-agent is a program to hold private keys used for public key authentication (RSA, DSA, ECDSA). The idea is that ssh-agent is started in
the beginning of an X-session or a login session, and all other windows or programs are started as clients to the ssh-agent program. Through
use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using
The agent initially does not have any private keys. Keys are added using ssh-add(1). When executed without arguments, ssh-add(1) adds the
~/.ssh/identity. If the identity has a passphrase, ssh-add(1) asks for the
passphrase on the terminal if it has one or from a small X11 program if running under X11. If neither of these is the case then the authentication will fail. It then sends the identity to the agent. Several identities can be stored in the agent; the agent can automatically use
any of these identities.
ssh-add -l displays the identities currently held by the agent.
Starting with macOS Sierra 10.12.2, Apple has added a UseKeychain config option for SSH configs.
You can activate this feature by adding
UseKeychain yes to your
I do not use OSX but did find this Q&A on SuperUser titled: How to use Mac OS X Keychain with SSH keys?.
I understand that since Mac OS X Leopard the Keychain has supported storing SSH keys. Could someone please explain how this feature is supposed to work.
So from the sound of it you could import your SSH keys into Keychain using this command:
$ ssh-add -K [path/to/private SSH key]
Your keys should then persist from boot to boot.
Whenever you reboot your Mac, all the SSH keys in your keychain will be automatically loaded. You should be able to see the keys in the Keychain Access app, as well as from the command line via:
Source: Super User - How to use Mac OS X Keychain with SSH keys?
In later versions of MacOS you may encounter this message when attempting to use the
-A switches. For e.g.:
$ ssh-add -K
WARNING: The -K and -A flags are deprecated and have been replaced
by the --apple-use-keychain and --apple-load-keychain
flags, respectively. To suppress this warning, set the
environment variable APPLE_SSH_ADD_BEHAVIOR as described in
the ssh-add(1) manual page.
So instead use the guidance provided by the warning message:
$ ssh-add --apple-load-keychain --apple-load-keychain
Identity added: /Users/slm/.ssh/somekey1_id_rsa (/Users/slm/.ssh/somekey1_id_rsa)
Identity added: /Users/slm/.ssh/somekey2_id_rsa (/Users/slm/.ssh/somekey2_id_rsa)
You can also suppress that warning using this environment variable,
APPLE_SSH_ADD_BEHAVIOR with the value
macos. From the
ssh-add man page:
$ man ssh-add
Enables or disables the older processing of the -A and -K
options used in earlier macOS releases. These options have
been renamed --apple-load-keychain and --apple-use-keychain
respectively. However, -A and -K still behave as in earlier
releases except in the following circumstances. If a
security provider was specified with -S or SSH_SK_PROVIDER,
or if APPLE_SSH_ADD_BEHAVIOR is set to the value “openssh”,
then ssh-add uses standard OpenSSH behavior: the -A flag is
not recognized and the -K flag behaves as documented in the
DESCRIPTION section above.
Otherwise, ssh-add -A and -K will behave as in earlier macOS
releases. A warning will be output to standard error unless
APPLE_SSH_ADD_BEHAVIOR is set to the value “macos”. Note:
Future releases of macOS will not support neither -A nor -K
without setting this environment variable.