3

tl;dr: I have identities in the ssh-agent. All of those but one gets used; one gets added to agent and keychain when I use it, but then I get prompted for the passphrase again and again, as if the key wasn't in the agent (and if it wasn't, as if the agent couldn't get the passphrase out of the keychain).

Details:

I have a bunch of SSH (RSA, protocol 2) keys for which I use agent and store the passphrases in the keychain.

For one (and only one) of those keys, and only recently, SSH started ignoring the identity in the agent. That is:

  • I connect using the key (ssh -i keyfile user@host, IdentitiesOnly is true for Host *)
  • OS X asks for the passphrase; I set the save in keychain checkbox.
  • the identity implicitly gets added to the agent, the keychain entry is added
  • I close the connection
  • I reconnect
  • I again get asked for the passphrase, as if the agent and/or keychain entries didn't exist

I have verified that: - The keychain entry is set to "always allow" for ssh, ssh-add and ssh-agent. - The key file has correct permissions set. - The identity is loaded in the agent. - Login works with that ID, provided I type in the passphrase every time.

What I have tried:

  • Deleting the whole keychain entry, then started ssh again. I got prompted for the passphrase, entered it, the entry in the keychain and the identity in the agent got added; connection worked, next time got asked again.
  • Renaming the key file itself. New keychain entry gets created, connection works, but on next connection I get asked for the passphrase again.
  • I have run ssh-add -D followed by ssh-add -k. I have verified that the offending key is among the identities added; so, in principle, the communication between agent and keychain seems to work. Still asks again.

This doesn't happen with any of my other keys and the key itself works for SSH. It also gets really annoying since I use quite strong passphrases for keys.

3 Answers 3

3

You should not use the '-i keyfile' argument once the identity is present in your agent.

Try this:

ssh-add keyfile
ssh -v user@host

(The v will help you debug)

1
  • Thanks for the good hint, but it wasn't quite it…at least you brought me back to note that I had already solved it, and how! :)
    – Bernd Haug
    Nov 9, 2011 at 20:14
0

Turns out the problem was that I had too many IDs in my agent. Normally, ssh will ignore the -i option once it has identities in the agent and just use the identities in the agent in turn. If you have more than, say, 5, in there, servers will reject them all and then revert to using passwords because there were too many unsuccessful tries.

Setting identitiesonly in the host * makes ssh go by the -i option (or identityfile in the .ssh/config again, but will still look in the agent if the specified identity is already unlocked, so that fixed this issue from any angle.

0

Follow Dave Dribin's Blog (ssh-agent on Mac OS X 10.5 (Leopard)

You should to run follow command:

ssh-add -k /path/to/your/private/key

After that you check your configurations via:

sh-add -L

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .