1

I have a passphrase-protected SSH key stored in ~/.ssh/id_rsa. In my .zshrc I have this fragment:

if ! ssh-add -l > /dev/null; then
  ssh-add
fi

After booting, I usually open the terminal, see the passphrase prompt, then unlock my KeePass 2 DB, copy the passphrase to clipboard and paste it into the terminal to add the key to the agent.

A few days ago, I have rebooted the system, logged in, and opened the terminal. To my surprise, the passphrase prompt didn't appear. Surprised, I typed ssh-add -l to see my key already added. That was weird, but I hand-waved it away, thinking that I forgot that I've already typed the password.

A moment ago, I ran sudo systemctl kexec, and after logging in, the key was already added again. My KeePass DB was locked. The passphrase is long and random (/[a-zA-Z0-9]{20}/). This time I suspected it's something specific to kexec, but after yet another sudo systemctl kexec, the passphrase prompt appeared, the key wasn't added to the agent.

  • How come my SSH key is sometimes added to the agent after reboot?
  • Can it also happen after a cold boot? (yes)
  • What can I do to prevent it?

I'm using Pop!_OS 18.04, booting with UEFI off a GPT disk with LUKS-encrypted / and unencrypted /boot, no LVM if that matters.


Edit: I've just cold booted after 4 days and the key was already added to agent again.

  • 1
    Is your SSH key added to seahorse or some other key manager? It might add the keys automatically on login. – muru Nov 12 '19 at 6:54
  • 1
    @muru No, not to my knowledge. I've removed Seahorse and didn't install anything in its place. And even if I did, I'd expect it to prompt for a password. – gronostaj Nov 12 '19 at 6:59
0

Reinstalling Seahorse revealed that the key password was remembered in the system keyring. What was adding the key, I don't know, but I was able to remove the remembered password using Seahorse.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.