up vote 2 down vote favorite
1
share [g+] share [fb]

The only time the Mac OS X Terminal seems to ask for my identity file’s password, is when I restart. I’m fairly paranoid, and this seems insecure; how can I ensure it asks for the password every time I attempt to use the key?

link|improve this question
50% accept rate
What version of Mac OS X do you have ? – Studer Feb 16 '10 at 1:10
Snow Leopard, 10.6.2 – elliottcable Feb 16 '10 at 6:56
feedback

3 Answers

up vote 4 down vote accepted

The ssh-agent stores these for the lifetime of a session (see the ssh-agent options via 'man ssh-agent'). You can shorten the lifetime of a key added to the agent with 'ssh-agent -t 1' but the ss-agent is started by launchd at system startup. Here is a thread which describes how to deal with the problem: apple-discussion .

link|improve this answer
Cairo, good tip actually didn't know about the timeout. Thanks man. – delerious010 Feb 16 '10 at 13:44
That helped, as a matter of fact. I had to dig through that and the associated Reddit thread, but I eventually gave up on completely disabling the ssh-agent integration, and instead modified the org.openbsd.ssh-agent.plist to give me a one-minute timeout. Thanks! – elliottcable Feb 18 '10 at 0:35
Great answer, it worked for me. But I think it would be better if you posted the solution here, linking the thread to give credit for the answer. – Alexandre L Telles Aug 5 '10 at 22:12
feedback
up vote 2 down vote

I would add the following configuration option to .ssh/config:

Host *
    IdentitiesOnly yes

to disable the use of ssh-agent.

link|improve this answer
I can’t vote it up, apparently, because I don’t have enough reputation on SuperUser (I always thought you could vote-up responses to your own questions, but… whatever.) Accepted, though! That’s exactly the solution I originally wanted; much better than simply reducing the period to a minute or something. – elliottcable Aug 16 '10 at 3:50
In retrospect, I’ve changed my accepted answer to the other one; while this apparently achieves the goal, it doesn’t help the deeper problem: that ssh-agent is storing my key at all. With this solution, anybody could walk up, rm ~/.ssh/config, and SSH into my machines. (Well, theoretically …) – elliottcable Nov 24 '11 at 0:28
feedback
up vote 1 down vote

If it's only asking you when you log in, then it's being stored in one of two places : in the ssh-agent via ssh-add or via the OSx keychain.

Personally, I'd check the Keychain first as I've a fealing it's probably a safer bet on a GUI centric machine.

link|improve this answer
I checked the Keychain, no such luck. It must be ssh-agent. How can I fix it to not do that? (I’d mark this answer as accepted, except it doesn’t really solve my problem… not without more information…) – elliottcable Feb 16 '10 at 6:55
Sorry for the brevity, I wasn't in front of a Mac so I figured I'd give you enough information to be able to find the answer with. Assuming you didn't find it : 1. Clear ssh-agent : ssh-agent -D 2. The linux geek in me says, just add "unset SSH_AUTH_SOCK" to your ~/.bashrc file. ( You may want to execute it manually as well for it to take effect automatically ). This way, SSH won't know where to find the agent. 3. Disable agent altogether : a) launchctl unload /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist b) i believe a restart would be in order afterwards. – delerious010 Feb 16 '10 at 13:44
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.