195

I added a ssh key to the agent by:

$ ssh-add ~/.ssh/id_rsa_mac
Identity added: /Users/alex/.ssh/id_rsa_mac (/Users/alex/.ssh/id_rsa_mac)

After a reboot the agent doesn't have this key added anymore:

$ ssh-add -l
The agent has no identities.

Why did this happen?

7
  • I don't have time to answer fully right now, but gpg-agent in ssh mode will do what you want. Try that instead of the legacy ssh-agent. If this helps I could try and expand this when I get time later.
    – Vality
    Jul 1, 2014 at 10:13
  • @Vality: I doubt the gpg-agent will be persistent accross reboots. Jul 1, 2014 at 13:08
  • @PavelŠimerda It encrypts the private keys with the users password then places them into $HOME/.gnupg/private-keys-v1.d as soon as you add them with ssh-add. It really is persistent. Well assuming you have a non volatile home directory.
    – Vality
    Jul 1, 2014 at 13:32
  • @Vality: Shouldn't that be considered a security issue? Couldn't you just as well use a key without a passphrase and be done with it without needing any agent? Jul 5, 2014 at 20:09
  • 1
    @PavelŠimerda It is not really a security issue as the key is stored encrypted with the users password, it still needs the password typed each time the user logs in to decrypt it. Storing the key unencrypted means a user with root (or a thief who took your hard disk) could steal them from your home directory, with gnupg if they steal them they will be encrypted with your password and thus useless.
    – Vality
    Jul 5, 2014 at 23:39

8 Answers 8

213

The addition of keys to the agent is transient. They last only so long as the agent is running. If you kill it or restart your computer they're lost until you re-add them again. From the ssh-agent man page:

ssh-agent is a program to hold private keys used for public key authentication (RSA, DSA, ECDSA). The idea is that ssh-agent is started in the beginning of an X-session or a login session, and all other windows or programs are started as clients to the ssh-agent program. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh(1).

The agent initially does not have any private keys. Keys are added using ssh-add(1). When executed without arguments, ssh-add(1) adds the files ~/.ssh/id_rsa, ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/identity. If the identity has a passphrase, ssh-add(1) asks for the passphrase on the terminal if it has one or from a small X11 program if running under X11. If neither of these is the case then the authentication will fail. It then sends the identity to the agent. Several identities can be stored in the agent; the agent can automatically use any of these identities. ssh-add -l displays the identities currently held by the agent.

macOS Sierra

Starting with macOS Sierra 10.12.2, Apple has added a UseKeychain config option for SSH configs. You can activate this feature by adding UseKeychain yes to your ~/.ssh/config.

Host *
  UseKeychain yes

OSX Keychain

I do not use OSX but did find this Q&A on SuperUser titled: How to use Mac OS X Keychain with SSH keys?.

I understand that since Mac OS X Leopard the Keychain has supported storing SSH keys. Could someone please explain how this feature is supposed to work.

So from the sound of it you could import your SSH keys into Keychain using this command:

$ ssh-add -K [path/to/private SSH key]

Your keys should then persist from boot to boot.

Whenever you reboot your Mac, all the SSH keys in your keychain will be automatically loaded. You should be able to see the keys in the Keychain Access app, as well as from the command line via:

  ssh-add -l

Source: Super User - How to use Mac OS X Keychain with SSH keys?

11
  • really? On Linux I don't have this issue. Do I have to "ssh-add my_key" each time I restart my computer?
    – Incerteza
    Jul 1, 2014 at 2:37
  • 3
    @Alex As the answer explains, the agent automatically adds ~/.ssh/id_rsa. I'm guessing this is the location of your keyfile on linux. It is also possible you're not using the standard ssh key agent. There are others, such as gnome-keyring-daemon, which may have different behavior.
    – phemmer
    Jul 1, 2014 at 2:41
  • but on Mac it's named "id_rsa_mac". How do I make the agent add it automatically?
    – Incerteza
    Jul 1, 2014 at 2:45
  • 5
    Small sidenote, if your ssh-add command doesn't recognise the -K flag you probably are using the macports version of ssh-add ... you can bypass the macports version by specifying the full path to the OSX version of ssh-add like this : /usr/bin/ssh-add -K /path/to/private/key
    – ChrisR
    May 27, 2015 at 12:16
  • 1
    As @PavelŠimerda noted, ssh-add also automatically checks for an id_ed25519 file now. Nov 16, 2021 at 12:56
26

The ssh-agent is a session service that stores keys temporarily for the user.

The main purpose of SSH agent is to remember the cleartext version of a key secured using a passphrase. In other words, the key is stored on the disk encrypted using a passphrase and the owner of the key uses ssh-add or some GUI tool to provide the passphrase and instruct the agent to remember it until the session exits or the user requests removal explicitly.

If you're not using a passphrase and you're not using agent forwarding (which is insecure for most purposes anyway), you don't need the agent at all. Any SSH client should be able to read the key from the disk, either from a standard location, or from an explicitly specified ones.

The standard locations are listed in the manual page ssh(1):

The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa for protocol version 2.

When using nonstandard locations, you can use the -i switch to ssh described in the same manual page, or the respective option in the SSH client you are using.

1
  • 4
    +1 for advocating the non-use of ssh-agent
    – dg99
    Sep 18, 2014 at 18:36
14

In Sierra:

Use UseKeychain. (I haven't tried this but it sounds like the most correct solution.)

Or

ssh-add -K /your/key
echo ssh-add -A | cat >> ~/.bash_profile

Or create a plist file instead of appending to ~/.bash_profile.

Disclaimer: as others have noted, I don't know how secure it is to store ssh passphrases in keychain.

0
3

For me only solution to keep keys persistent after boot in ssh agent was to add these lines to ~/.bash_profile:

ssh-add -A 2>/dev/null;
ssh-add ~/.ssh/your_key 2>/dev/null;
2
  • your_key is the real ssh key or id_ed25519 ?
    – James78
    Mar 5 at 15:26
  • @James78 when I configured this I think the key was generated with RSA algorithm. But it should work for any algorithm generated key as it is just a path to the actual key that matters Mar 5 at 22:00
3

I do these to help me enable ssh identities after mac reboot. Works on updated macOS 10, 11 and 12.

  1. Make sure your ssh-key has passphrase when you create it because it is required for keychain. If you don't have, you still can modify your no-passphrase-privatekey to have one by runnint this command: ssh-keygen -p -f ~/.ssh/<.your-privatekey-filename.>

  2. Add your ssh private key to keychain by run this command: ssh-add --apple-use-keychain ~/.ssh/<.your-privatekey-filename.>

  3. Add all your SSH related private keys in keychain to your ssh-agent by running this command: ssh-add --apple-load-keychain

  4. Verify by running ssh-add -l. You should see a list of results if everything works well.

You would notice, after you reboot your computer you lost your ssh identity (ssh-add-l result no identity found ...). You can fix it by two ways:

  1. Add ssh-add --apple-load-keychain to your terminal profile, example if you use zsh add ssh-add --apple-load-keychain to ~/.zshrc or any of your profile configuration files.

  2. You can add a macOS startup script, by creating a file in ~/library/launchagents/com.<.yourusename.>.<.name of command.>.plist. For example, com.myusername.ssh.plist, containing:

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>Label</key>
      <string>com.user.loginscript</string>
    <key>ProgramArguments</key>
      <array>
        <string>ssh-add</string>
        <string>--apple-load-keychain</string>
      </array>
    <key>RunAtLoad</key>
      <true/>
    </dict>
    </plist>
    
  3. Tell launchd to load this script every reboot: launchctl load ~/Library/LaunchAgents/com.myusername.ssh.plist.

(If you don't know your username, run the id command to see your current username.)

2
  • ssh-add -A returns "unknown option -- A" May 16, 2020 at 19:02
  • 2
    @DanielKatz These instructions are outdated. The -A option has been renamed to --apple-load-keychain. The -K is renamed to --apple-use-keychain. See man ssh-add
    – oligofren
    Feb 4 at 5:54
2

Note that almost none of the answers above have a solution for this issue. I have both Linux and MacOs solutions listed below.

On Linux, this same issue occurs. As others have stated, this is because ssh-add is only temporary. The solution is to either add ssh-add command to .bashrc or simply not use it.

The solution is as described by this answer to How to tell git which private key to use?

Option 4: ~/.ssh/config

Use the ~/.ssh/config file as suggested in other answers in order to specify the location of your private key, e.g.

Host github.com
  User git
  Hostname github.com
  IdentityFile ~/.ssh/id_rsa

On Mac, the following line added to config in ~/.ssh/config worked for me

Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/github

I didn't test this answer to macOS Sierra doesn’t seem to remember SSH keys between reboots but I think this is what you're looking for.

1
  • 1
    Please include quotes as blockquoted text *not as an image. Text within an image is not searchable. Oct 11, 2021 at 13:45
1

If you use ZSH, there is a very good plugin:

https://github.com/hkupty/ssh-agent

To install using zplug (a better oh-my-zsh):

zplug "hkupty/ssh-agent", from:github
0

As an alternative (especially in Linux where -K does something else), you can add the following line to your ~/.ssh/config:

AddKeysToAgent yes

This way when you first use a given key after reboot, you'll get asked for the password, but then SSH will keep it in agent. This way the password isn't stored anywhere and it's still very convenient.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.