SSH keys can't be deleted from agent

Question

My Ubuntu 18.04 keeps adding all my SSH keys into the ssh agent upon startup and I am unable to delete them. Having so many keys in the agent breaks authentication to servers that only permit 3 or 5 attempts.

~ $ ssh-add -l
2048 SHA256:7mW8C9RNZ75U...ArHq+9kSZLmny0Y google_compute_engine (RSA)
2048 SHA256:OUD4Vy0LKWp2...AwNKTbdHDkjVkcU id_rsa.aws (RSA)
2048 SHA256:/Qbw+NcgXBTk...pi7bYs2eYm0k7B8 id_rsa.aws-eu (RSA)
2048 SHA256:cG5xEwfejo2O...8LqmP4gk2wAtzrk id_rsa (RSA)
2048 SHA256:5TgVaBUrlSvV...PHM46avPZIauVRY sftp-test2 (RSA)

When I try to delete them it says OK but they are still there:

~ $ ssh-add -D
All identities removed.

~ $ ssh-add -l
2048 SHA256:7mW8C9RNZ75U...ArHq+9kSZLmny0Y google_compute_engine (RSA)
2048 SHA256:OUD4Vy0LKWp2...AwNKTbdHDkjVkcU id_rsa.aws (RSA)
2048 SHA256:/Qbw+NcgXBTk...pi7bYs2eYm0k7B8 id_rsa.aws-eu (RSA)
2048 SHA256:cG5xEwfejo2O...8LqmP4gk2wAtzrk id_rsa (RSA)
2048 SHA256:5TgVaBUrlSvV...PHM46avPZIauVRY sftp-test2 (RSA)

With so many identities loaded in the agent I can't even specify an explicit on the command line, it still fails:

~ $ ssh 192.168.56.5  -i ~/.ssh/test
Received disconnect from 192.168.56.5 port 22:2: Too many authentication failures
Disconnected from 192.168.56.5 port 22

The only thing I can do is unset SSH_AUTH_SOCK altogether and then I can at least use ssh -i ... but that's inconvenient.

TL;DR

How can I delete all the identities from the agent and prevent them from loading again next time? Ie how to make it behave like ssh agent used to?

Answer 1

This may be due to a bug in ssh-add -d/-D not removing keys. There were some bug reports about it, e.g.

• Debian Bug report #472477: ssh-add -D does not remove SSH key from gnome-keyring-daemon memory
• Ubuntu: ssh-add -D deleting all identities does not work. Also, why are all identities auto-added?

The exact issue is:

ssh-add -d/-D deletes only manually added keys from gnome-keyring. There is no way to delete automatically added keys. This is the original bug, and it's still definitely present.

Allowing ssh-add -d to apply to automatically-loaded keys (and ssh-add -t X to change the lifetime of automatically-loaded keys), would restore the behaviour most users expect.

A possible workaround:

Do ssh-add -D to delete all your manually added keys.

Navigate to your ~/.ssh folder and move all your key files except the one you want to identify with into a separate folder called backup. If necessary you can also open seahorse and delete the keys from there.

Another workaround:

What you really want to do is to turn off gpg-keyring-daemon altogether. Go to System --> Preferences --> Startup Applications, and unselect the "SSH Key Agent (Gnome Keyring SSH Agent)" box -- you'll need to scroll down to find it.

You'll still get an ssh-agent, only now it will behave sanely: no keys autoloaded, you run ssh-add to add them, and if you want to delete keys, you can.

This comments actually suggests:

The solution is to keep gnome-keyring-manager from ever starting up, which was strangely difficult by finally achieved by removing the program file's execute permission.