4

I regularly use my Mac to ssh into other systems on my local network.

I have a public/private key (which was created 6 years ago) so I can connect without using a password.

Recently (probably since upgrading to 10.12.4) the Mac prompts with Enter passphrase for key '/Users/user/.ssh/id_rsa':

Why has this suddenly started happening? (I presume this has something to do with changes to ssh OpenSSH_7.4p1, LibreSSL 2.5.0)

Can I get ssh to connect without asking for passphrase?

Alternatively I can use a new key pair, but can I ssh-keygen to remove the passphrase without affecting the public key?

There seem to be a number of related questions, but no solutions which seem applicable to the Mac.

Possibly useful information:-

id_rsa

Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0F1575DBFB9CA6CD

ssh-add -l shows

2048 SHA256:XQGzZVv9orlvUu6t7XIfxi89EaroG9CU2Z2WQ71kST8 ~/.ssh/id_rsa (RSA)

ssh-agent

SSH_AUTH_SOCK=/var/folders/b7/k8m8pvdx0kl3kjhbk8q2kchm0000gn/T//ssh-gmetYqUf36ZC/agent.10219; export SSH_AUTH_SOCK;
SSH_AGENT_PID=10220; export SSH_AGENT_PID;
echo Agent pid 10220;
Improve this question
1
  • I would say that could be solved using keychan, it you do not mind compromising your security. I would regenerate that key with a more modern crypto too.
    – Rui F Ribeiro
    Commented Apr 10, 2017 at 8:12

1 Answer 1

Reset to default
6

If you generated the key pair with a passphrase, this is the desired behaviour. If you don't want to enter a passphrase, chose an empty one.

If it would be possible to generate a new key with the same public key, there wouldn't be any security anymore, so you can't do that.

I suggest to let Keychain enter the password for you. Edit ~/.ssh/config and add the option:

Host *
    UseKeychain yes
Improve this answer
3
  • Maybe "this is the desired behaviour", but NOT the way it has been working for the last 4 years. I tried both options; create a new key without passphrase. This works but now prompts for password. I might as well just allow ssh password access. The UseKeychain seemed to make to difference.
    – Milliways
    Commented Apr 12, 2017 at 5:27
  • Sorry you misunderstood me: Not the behaviour you desired, just from ssh point of view ("if you don't want to enter a passphrase, don't give one on generating). So, did the option solve your problem?
    – Philippos
    Commented Apr 12, 2017 at 6:22
  • UseKeychain did not work. I have read the ssh_config man, but the passphrase never seemed to be added or accessed. The new key without passphrase works, when I set the -i on ssh
    – Milliways
    Commented Apr 12, 2017 at 8:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .