148

I added a ssh key to the agent by:

$ ssh-add ~/.ssh/id_rsa_mac
Identity added: /Users/alex/.ssh/id_rsa_mac (/Users/alex/.ssh/id_rsa_mac)

After a reboot the agent doesn't have this key added anymore:

$ ssh-add -l
The agent has no identities.

Why did this happen?

  • I don't have time to answer fully right now, but gpg-agent in ssh mode will do what you want. Try that instead of the legacy ssh-agent. If this helps I could try and expand this when I get time later. – Vality Jul 1 '14 at 10:13
  • @Vality: I doubt the gpg-agent will be persistent accross reboots. – Pavel Šimerda Jul 1 '14 at 13:08
  • @PavelŠimerda It encrypts the private keys with the users password then places them into $HOME/.gnupg/private-keys-v1.d as soon as you add them with ssh-add. It really is persistent. Well assuming you have a non volatile home directory. – Vality Jul 1 '14 at 13:32
  • @Vality: Shouldn't that be considered a security issue? Couldn't you just as well use a key without a passphrase and be done with it without needing any agent? – Pavel Šimerda Jul 5 '14 at 20:09
  • 1
    @PavelŠimerda It is not really a security issue as the key is stored encrypted with the users password, it still needs the password typed each time the user logs in to decrypt it. Storing the key unencrypted means a user with root (or a thief who took your hard disk) could steal them from your home directory, with gnupg if they steal them they will be encrypted with your password and thus useless. – Vality Jul 5 '14 at 23:39
173

The addition of keys to the agent is transient. They last only so long as the agent is running. If you kill it or restart your computer they're lost until you re-add them again. From the ssh-agent man page:

ssh-agent is a program to hold private keys used for public key authentication (RSA, DSA, ECDSA). The idea is that ssh-agent is started in the beginning of an X-session or a login session, and all other windows or programs are started as clients to the ssh-agent program. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh(1).

The agent initially does not have any private keys. Keys are added using ssh-add(1). When executed without arguments, ssh-add(1) adds the files ~/.ssh/id_rsa, ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/identity. If the identity has a passphrase, ssh-add(1) asks for the passphrase on the terminal if it has one or from a small X11 program if running under X11. If neither of these is the case then the authentication will fail. It then sends the identity to the agent. Several identities can be stored in the agent; the agent can automatically use any of these identities. ssh-add -l displays the identities currently held by the agent.

macOS Sierra

Starting with macOS Sierra 10.12.2, Apple has added a UseKeychain config option for SSH configs. You can activate this feature by adding UseKeychain yes to your ~/.ssh/config.

Host *
  UseKeychain yes

OSX Keychain

I do not use OSX but did find this Q&A on SuperUser titled: How to use Mac OS X Keychain with SSH keys?.

I understand that since Mac OS X Leopard the Keychain has supported storing SSH keys. Could someone please explain how this feature is supposed to work.

So from the sound of it you could import your SSH keys into Keychain using this command:

$ ssh-add -K [path/to/private SSH key]

Your keys should then persist from boot to boot.

Whenever you reboot your Mac, all the SSH keys in your keychain will be automatically loaded. You should be able to see the keys in the Keychain Access app, as well as from the command line via:

  ssh-add -l

Source: Super User - How to use Mac OS X Keychain with SSH keys?

  • really? On Linux I don't have this issue. Do I have to "ssh-add my_key" each time I restart my computer? – アレックス Jul 1 '14 at 2:37
  • 2
    @Alex As the answer explains, the agent automatically adds ~/.ssh/id_rsa. I'm guessing this is the location of your keyfile on linux. It is also possible you're not using the standard ssh key agent. There are others, such as gnome-keyring-daemon, which may have different behavior. – Patrick Jul 1 '14 at 2:41
  • but on Mac it's named "id_rsa_mac". How do I make the agent add it automatically? – アレックス Jul 1 '14 at 2:45
  • @Patrick: I'm not sure whether the classic ssh-agent adds any keys automatically. In my opinion it's ssh-add that reads the standard locations, or the ssh client if you're not using the agent. – Pavel Šimerda Jul 1 '14 at 6:58
  • 5
    Small sidenote, if your ssh-add command doesn't recognise the -K flag you probably are using the macports version of ssh-add ... you can bypass the macports version by specifying the full path to the OSX version of ssh-add like this : /usr/bin/ssh-add -K /path/to/private/key – ChrisR May 27 '15 at 12:16
20

The ssh-agent is a session service that stores keys temporarily for the user.

The main purpose of SSH agent is to remember the cleartext version of a key secured using a passphrase. In other words, the key is stored on the disk encrypted using a passphrase and the owner of the key uses ssh-add or some GUI tool to provide the passphrase and instruct the agent to remember it until the session exits or the user requests removal explicitly.

If you're not using a passphrase and you're not using agent forwarding (which is insecure for most purposes anyway), you don't need the agent at all. Any SSH client should be able to read the key from the disk, either from a standard location, or from an explicitly specified ones.

The standard locations are listed in the manual page ssh(1):

The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa for protocol version 2.

When using nonstandard locations, you can use the -i switch to ssh described in the same manual page, or the respective option in the SSH client you are using.

  • 4
    +1 for advocating the non-use of ssh-agent – dg99 Sep 18 '14 at 18:36
7

In Sierra:

Use UseKeychain. (I haven't tried this but it sounds like the most correct solution.)

Or

ssh-add -K /your/key
echo ssh-add -A | cat >> ~/.bash_profile

Or create a plist file instead of appending to ~/.bash_profile.

Disclaimer: as others have noted, I don't know how secure it is to store ssh passphrases in keychain.

  • I tried all methods above but only this one works. Thank you! – Duannx Feb 26 at 3:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.