Before we start, let's clarify a couple of points:
- macOS will allow you to store the private key passphrases in the macOS keychain.
- ssh-agent (on macOS or any system) holds the decrypted private key in memory.
The distinction is important to answer your questions.
- It seems like there are two options: ssh-agent or Keychain Access.
Not exactly. See clarification above. If you use the
UseKeychain yes directive in your
~/.ssh/config, then any program connecting to the
ssh-agent socket will allow
ssh-agent to reach into the Keychain for the passphrase to decrypt your private key. If you also use the the
AddKeysToAgent yes directive, then that decrypted key will be stored in the agent for future use. Also useful to see another related question.
... If you need the convenience of temporarily storing passphrases, what is the standard?
There is (to my knowledge) no way to have macOS store the passphrases temporarily. However, a partially satisfying solution for nearly the same effect can be had -- see answer to question 3 below.
- How can I identify and clear the passphrase for my default private key in Keychain Access? I see an unnamed private key, but I don't want to delete it without knowing for sure that it is my stored SSH key.
If you open Keychain Access on your Mac, and search for
ssh, you likely won't see your ssh key passphrase. Starting with macOS Sierra (10.12), Apple moved which keychain
ssh keys were stored. To see it, you need to select "View >> Show Invisible Items" and then ssh key passphrase entries will be visible.
Chances are the "unnamed private key" you were seeing was some other RSA (or DSA) key.
- What is the best option if I want to regularly clear any private key passphrases? I could use
ssh-add -D under a cron job.
While you could put
ssh-add -D into a cron job, and it probably would do some of what you want, it would not remove the passphrases from the keychain. It would only clear the memory of the running
ssh-agent of all decrypted private keys. If you have
UseKeychain yes in your config,
ssh-agent will happily re-decrypt the key again next time it is needed (see above answer to question 1).
One alternative to satisfy your implied desire to not have decrypted keys available all the time is to turn off both
AddKeysToAgent, as in:
Then, manually add keys to your running
ssh-agent with limited lifetimes using the
-t <lifetime> option to
ssh-add, as in:
ssh-add -t 4h ~/.ssh/id_rsa
That will add your (default) RSA key to the agent with a lifetime of 4 hours. After four hours, the key will be removed automatically.
As far as I know, there is no directive for your user
~/.ssh/config to specify the default lifetime of any key added to the agent, nor is there a way in the system
sshd_config. However, there may be a way to tell macOS to start the agent with a default lifetime using the
-t <lifetime> option. For the intrepid, the launch agent plist file is stored in
Another older, possibly still relevant approach locks they keychain while sleeping.