Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
In order to forget private keys passphrase (id_rsa) i usually run:
ssh-add -D # to forget all loaded identities
ssh-add -d # to forget primary identity ($HOME/.ssh/id_rsa)
Now with macOS Sierra v10.12.1 i get this error:
$ ssh-add -D
All identities removed.
$ ssh-add -d
Could not remove identity "/Users/user/.ssh/id_rsa": agent refused operation
Could not remove identity "/Users/user/.ssh/id_dsa": agent refused operation
I searched google with no luck!
I had the same issue with Sierra. Try removing id_rsa from $HOME/.ssh/ and then restarting (I removed id_rsa.pub as well - therefore the two keys private and public). It solved my problem.
This error happened to me when the identity being referenced was different from the one that was added. The -d option removes a specific key. If that key was never loaded it refuses to remove it. You can check the keys loaded with ssh-add -l and check key signatures with ssh-keygen -lf <path-to-private-key>
In my case, I had a slightly different problem. When I invoked ssh-add -D the agent appeared to succeed and responded with All identities removed. but in fact, when listing the agent keys ssh-add -l the unwanted keys remained listed, and of course, when attempting to use the agent to authenticate to a remote host the agent would prompt me using my configured pin program for a passphrase to the unwanted keys. Annoying.
The cause of the problem was that my gpg-agent daemon had cached the keys in a file at the path ~/.gnupg/sshcontrol:
$ cat ~/.gnupg/sshcontrol
# List of allowed ssh keys. Only keys present in this file are used
# in the SSH protocol. The ssh-add tool may add new entries to this
# file to enable them; you may also add them manually. Comment
# lines, like this one, as well as empty lines are ignored. Lines do
# have a certain length limit but this is not serious limitation as
# the format of the entries is fixed and checked by gpg-agent. A
# non-comment line starts with optional white spaces, followed by the
# keygrip of the key given as 40 hex digits, optionally followed by a
# caching TTL in seconds, and another optional field for arbitrary
# flags. Prepend the keygrip with an '!' mark to disable it.
# RSA key added on: 2021-06-03 16:23:25
# Fingerprints: MD5:c1:[elided]:24
# SHA256:+Mj[elided]E4
21[elided]C9 0
# Ed25519 key added on: 2021-06-03 22:11:36
# Fingerprints: MD5:[elided]:24:da
# SHA256:EL[elided]Zs
E0[elided]47 0
Deleting those keys from the ~/.gnupg/sshcontrol allowed me to resume use of the gpg-agent to authenticate to remote hosts without the agent demanding a passphrase for keys which I was no longer using.
Had the same Issue, fixed with
🤖 killall ssh-agent
🤖 ssh-add -l
The agent has no identities.
I found that Ubuntu 18.04 still have this bug.
Here is my simple way to remove unwanted key(s) from ssh-agent without any significant effort:
Find the key you want to remove
ssh-add -l
2048 SHA256:qzJYF7AJAJsLsJn7ZFPcJ+w78ZJVoPZI9TzXCq2cf5 .ssh/bad-key.pem (RSA)
Go into your ~/.ssh directory and create sub-directory called for example, disabled
cd ~/.ssh
mkdir disabled
Move the key you want to disable into that directory.
mv bad-key.pem disabled/
That's it. The key should be no longer available in the ssh-agent, but you can still have it and add it back if you need to.
If none of the above works, for me it was the ~/.gnupg/sshcontrol where the keys got "cached".
