tl;dr: I have identities in the ssh-agent. All of those but one gets used; one gets added to agent and keychain when I use it, but then I get prompted for the passphrase again and again, as if the key wasn't in the agent (and if it wasn't, as if the agent couldn't get the passphrase out of the keychain).
Details:
I have a bunch of SSH (RSA, protocol 2) keys for which I use agent and store the passphrases in the keychain.
For one (and only one) of those keys, and only recently, SSH started ignoring the identity in the agent. That is:
- I connect using the key (
ssh -i keyfile user@host
,IdentitiesOnly
is true forHost *
) - OS X asks for the passphrase; I set the save in keychain checkbox.
- the identity implicitly gets added to the agent, the keychain entry is added
- I close the connection
- I reconnect
- I again get asked for the passphrase, as if the agent and/or keychain entries didn't exist
I have verified that: - The keychain entry is set to "always allow" for ssh, ssh-add and ssh-agent. - The key file has correct permissions set. - The identity is loaded in the agent. - Login works with that ID, provided I type in the passphrase every time.
What I have tried:
- Deleting the whole keychain entry, then started ssh again. I got prompted for the passphrase, entered it, the entry in the keychain and the identity in the agent got added; connection worked, next time got asked again.
- Renaming the key file itself. New keychain entry gets created, connection works, but on next connection I get asked for the passphrase again.
- I have run
ssh-add -D
followed byssh-add -k
. I have verified that the offending key is among the identities added; so, in principle, the communication between agent and keychain seems to work. Still asks again.
This doesn't happen with any of my other keys and the key itself works for SSH. It also gets really annoying since I use quite strong passphrases for keys.