1

For the sake of convenience, I would like MacOS to hold on to my RSA passphrase, but not indefinitely (for the sake of security). I believe SSH will use Keychain Access with this SSH configuration

Host *
     UseKeychain true

And I believe it will use ssh-agent with this configuration:

Host *
     AddKeysToAgent yes

A few questions:

  1. It seems like there are two options: ssh-agent or Keychain Access. If you need the convenience of temporarily storing passphrases, what is the standard?
  2. How can I identify and clear the passphrase for my default private key in Keychain Access? I see an unnamed private key, but I don't want to delete it without knowing for sure that it is my stored SSH key
  3. What is the best option if I want to regularly clear any private key passphrases? I could use ssh-add -D under a cron job
3

Before we start, let's clarify a couple of points:

  • macOS will allow you to store the private key passphrases in the macOS keychain.
  • ssh-agent (on macOS or any system) holds the decrypted private key in memory.

The distinction is important to answer your questions.

  1. It seems like there are two options: ssh-agent or Keychain Access.

Not exactly. See clarification above. If you use the UseKeychain yes directive in your ~/.ssh/config, then any program connecting to the ssh-agent socket will allow ssh-agent to reach into the Keychain for the passphrase to decrypt your private key. If you also use the the AddKeysToAgent yes directive, then that decrypted key will be stored in the agent for future use. Also useful to see another related question.

... If you need the convenience of temporarily storing passphrases, what is the standard?

There is (to my knowledge) no way to have macOS store the passphrases temporarily. However, a partially satisfying solution for nearly the same effect can be had -- see answer to question 3 below.

  1. How can I identify and clear the passphrase for my default private key in Keychain Access? I see an unnamed private key, but I don't want to delete it without knowing for sure that it is my stored SSH key.

If you open Keychain Access on your Mac, and search for ssh, you likely won't see your ssh key passphrase. Starting with macOS Sierra (10.12), Apple moved which keychain ssh keys were stored. To see it, you need to select "View >> Show Invisible Items" and then ssh key passphrase entries will be visible.

Chances are the "unnamed private key" you were seeing was some other RSA (or DSA) key.

  1. What is the best option if I want to regularly clear any private key passphrases? I could use ssh-add -D under a cron job.

While you could put ssh-add -D into a cron job, and it probably would do some of what you want, it would not remove the passphrases from the keychain. It would only clear the memory of the running ssh-agent of all decrypted private keys. If you have UseKeychain yes in your config, ssh-agent will happily re-decrypt the key again next time it is needed (see above answer to question 1).

One alternative to satisfy your implied desire to not have decrypted keys available all the time is to turn off both UseKeychain and AddKeysToAgent, as in:

Host *
  UseKeychain no
  AddKeysToAgent no

Then, manually add keys to your running ssh-agent with limited lifetimes using the -t <lifetime> option to ssh-add, as in:

ssh-add -t 4h ~/.ssh/id_rsa

That will add your (default) RSA key to the agent with a lifetime of 4 hours. After four hours, the key will be removed automatically.

As far as I know, there is no directive for your user ~/.ssh/config to specify the default lifetime of any key added to the agent, nor is there a way in the system sshd_config. However, there may be a way to tell macOS to start the agent with a default lifetime using the -t <lifetime> option. For the intrepid, the launch agent plist file is stored in /System/Library/LaunchAgents/com.openssh.ssh-agent.plist.

Another older, possibly still relevant approach locks they keychain while sleeping.

| improve this answer | |
  • very detailed and informative answer, thanks! – Alexandre L Telles Nov 18 '19 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.