3

I regularly use my Mac to ssh into other systems on my local network.

I have a public/private key (which was created 6 years ago) so I can connect without using a password.

Recently (probably since upgrading to 10.12.4) the Mac prompts with Enter passphrase for key '/Users/user/.ssh/id_rsa':

Why has this suddenly started happening? (I presume this has something to do with changes to ssh OpenSSH_7.4p1, LibreSSL 2.5.0)

Can I get ssh to connect without asking for passphrase?

Alternatively I can use a new key pair, but can I ssh-keygen to remove the passphrase without affecting the public key?

There seem to be a number of related questions, but no solutions which seem applicable to the Mac.

Possibly useful information:-

id_rsa

Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,0F1575DBFB9CA6CD

ssh-add -l shows

2048 SHA256:XQGzZVv9orlvUu6t7XIfxi89EaroG9CU2Z2WQ71kST8 ~/.ssh/id_rsa (RSA)

ssh-agent

SSH_AUTH_SOCK=/var/folders/b7/k8m8pvdx0kl3kjhbk8q2kchm0000gn/T//ssh-gmetYqUf36ZC/agent.10219; export SSH_AUTH_SOCK;
SSH_AGENT_PID=10220; export SSH_AGENT_PID;
echo Agent pid 10220;
  • I would say that could be solved using keychan, it you do not mind compromising your security. I would regenerate that key with a more modern crypto too. – Rui F Ribeiro Apr 10 '17 at 8:12
4

If you generated the key pair with a passphrase, this is the desired behaviour. If you don't want to enter a passphrase, chose an empty one.

If it would be possible to generate a new key with the same public key, there wouldn't be any security anymore, so you can't do that.

I suggest to let Keychain enter the password for you. Edit ~/.ssh/config and add the option:

Host *
    UseKeychain yes
  • Maybe "this is the desired behaviour", but NOT the way it has been working for the last 4 years. I tried both options; create a new key without passphrase. This works but now prompts for password. I might as well just allow ssh password access. The UseKeychain seemed to make to difference. – Milliways Apr 12 '17 at 5:27
  • Sorry you misunderstood me: Not the behaviour you desired, just from ssh point of view ("if you don't want to enter a passphrase, don't give one on generating). So, did the option solve your problem? – Philippos Apr 12 '17 at 6:22
  • UseKeychain did not work. I have read the ssh_config man, but the passphrase never seemed to be added or accessed. The new key without passphrase works, when I set the -i on ssh – Milliways Apr 12 '17 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.