Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite
1

The only time the Mac OS X Terminal seems to ask for my identity file’s password, is when I restart. I’m fairly paranoid, and this seems insecure; how can I ensure it asks for the password every time I attempt to use the key?

share|improve this question
What version of Mac OS X do you have ? – Studer Feb 16 '10 at 1:10
Snow Leopard, 10.6.2 – elliottcable Feb 16 '10 at 6:56

3 Answers

up vote 4 down vote accepted

The ssh-agent stores these for the lifetime of a session (see the ssh-agent options via 'man ssh-agent'). You can shorten the lifetime of a key added to the agent with 'ssh-agent -t 1' but the ss-agent is started by launchd at system startup. Here is a thread which describes how to deal with the problem: apple-discussion .

share|improve this answer
Cairo, good tip actually didn't know about the timeout. Thanks man. – delerious010 Feb 16 '10 at 13:44
That helped, as a matter of fact. I had to dig through that and the associated Reddit thread, but I eventually gave up on completely disabling the ssh-agent integration, and instead modified the org.openbsd.ssh-agent.plist to give me a one-minute timeout. Thanks! – elliottcable Feb 18 '10 at 0:35
Great answer, it worked for me. But I think it would be better if you posted the solution here, linking the thread to give credit for the answer. – Alexandre L Telles Aug 5 '10 at 22:12
up vote 1 down vote

If it's only asking you when you log in, then it's being stored in one of two places : in the ssh-agent via ssh-add or via the OSx keychain.

Personally, I'd check the Keychain first as I've a fealing it's probably a safer bet on a GUI centric machine.

share|improve this answer
I checked the Keychain, no such luck. It must be ssh-agent. How can I fix it to not do that? (I’d mark this answer as accepted, except it doesn’t really solve my problem… not without more information…) – elliottcable Feb 16 '10 at 6:55
Sorry for the brevity, I wasn't in front of a Mac so I figured I'd give you enough information to be able to find the answer with. Assuming you didn't find it : 1. Clear ssh-agent : ssh-agent -D 2. The linux geek in me says, just add "unset SSH_AUTH_SOCK" to your ~/.bashrc file. ( You may want to execute it manually as well for it to take effect automatically ). This way, SSH won't know where to find the agent. 3. Disable agent altogether : a) launchctl unload /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist b) i believe a restart would be in order afterwards. – delerious010 Feb 16 '10 at 13:44
up vote 2 down vote

I would add the following configuration option to .ssh/config:

Host *
    IdentitiesOnly yes

to disable the use of ssh-agent.

share|improve this answer
I can’t vote it up, apparently, because I don’t have enough reputation on SuperUser (I always thought you could vote-up responses to your own questions, but… whatever.) Accepted, though! That’s exactly the solution I originally wanted; much better than simply reducing the period to a minute or something. – elliottcable Aug 16 '10 at 3:50
In retrospect, I’ve changed my accepted answer to the other one; while this apparently achieves the goal, it doesn’t help the deeper problem: that ssh-agent is storing my key at all. With this solution, anybody could walk up, rm ~/.ssh/config, and SSH into my machines. (Well, theoretically …) – elliottcable Nov 24 '11 at 0:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.