The only time the Mac OS X Terminal seems to ask for my identity file’s password, is when I restart. I’m fairly paranoid, and this seems insecure; how can I ensure it asks for the password every time I attempt to use the key?

  • What version of Mac OS X do you have ? – Studer Feb 16 '10 at 1:10
  • Snow Leopard, 10.6.2 – ELLIOTTCABLE Feb 16 '10 at 6:56

The ssh-agent stores these for the lifetime of a session (see the ssh-agent options via 'man ssh-agent'). You can shorten the lifetime of a key added to the agent with 'ssh-agent -t 1' but the ss-agent is started by launchd at system startup. Here is a thread which describes how to deal with the problem: apple-discussion .

  • Cairo, good tip actually didn't know about the timeout. Thanks man. – jonathanserafini Feb 16 '10 at 13:44
  • That helped, as a matter of fact. I had to dig through that and the associated Reddit thread, but I eventually gave up on completely disabling the ssh-agent integration, and instead modified the org.openbsd.ssh-agent.plist to give me a one-minute timeout. Thanks! – ELLIOTTCABLE Feb 18 '10 at 0:35
  • Great answer, it worked for me. But I think it would be better if you posted the solution here, linking the thread to give credit for the answer. – Alexandre L Telles Aug 5 '10 at 22:12

I would add the following configuration option to .ssh/config:

Host *
    IdentitiesOnly yes

to disable the use of ssh-agent.

  • I can’t vote it up, apparently, because I don’t have enough reputation on SuperUser (I always thought you could vote-up responses to your own questions, but… whatever.) Accepted, though! That’s exactly the solution I originally wanted; much better than simply reducing the period to a minute or something. – ELLIOTTCABLE Aug 16 '10 at 3:50
  • In retrospect, I’ve changed my accepted answer to the other one; while this apparently achieves the goal, it doesn’t help the deeper problem: that ssh-agent is storing my key at all. With this solution, anybody could walk up, rm ~/.ssh/config, and SSH into my machines. (Well, theoretically …) – ELLIOTTCABLE Nov 24 '11 at 0:28

You can set the default (login) keychain to lock on sleep or after a timeout, which also seems to flush the SSH agent.

Open Keychain Access and right-click the login keychain to change settings (I guess you'll want a shorter timeout than me): Keychain Security Settings

Or if you prefer a commandline:

security set-keychain-settings -lu -t 1   # for a 1 second timeout

I was using the org.openbsd.ssh-agent.plist change you've mentioned in the comments, but on El Cap you need to disable System Integrity Protection to do that, which I wasn't crazy about. My solution requires an extra prompt to unlock, but it's the cleanest option I've found so far.


If it's only asking you when you log in, then it's being stored in one of two places : in the ssh-agent via ssh-add or via the OSx keychain.

Personally, I'd check the Keychain first as I've a fealing it's probably a safer bet on a GUI centric machine.

  • I checked the Keychain, no such luck. It must be ssh-agent. How can I fix it to not do that? (I’d mark this answer as accepted, except it doesn’t really solve my problem… not without more information…) – ELLIOTTCABLE Feb 16 '10 at 6:55
  • Sorry for the brevity, I wasn't in front of a Mac so I figured I'd give you enough information to be able to find the answer with. Assuming you didn't find it : 1. Clear ssh-agent : ssh-agent -D 2. The linux geek in me says, just add "unset SSH_AUTH_SOCK" to your ~/.bashrc file. ( You may want to execute it manually as well for it to take effect automatically ). This way, SSH won't know where to find the agent. 3. Disable agent altogether : a) launchctl unload /System/Library/LaunchAgents/org.openbsd.ssh-agent.plist b) i believe a restart would be in order afterwards. – jonathanserafini Feb 16 '10 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.