I have two machines, M1 and M2, both running OS X, and a third machine, L, running Linux. M1 and M2 have RSA keys unlocked in the Keychain, so I can:

  • ssh from M1 to M2 without being asked for a password or the key's passphrase
  • ssh from M2 to L without being asked for a password or the key's passphrase

However, when I ssh from M1 to M2, and then to L (while still physically on M1), it asks me for the key's passphrase! I've tried manually unlocking the login.keychain using the security command, but it seems to have no effect.

What's going wrong? How can I double ssh without typing any passphrases?


The keychain is working exactly as it should, what the -A does is it forwards your loaded keys from M1 through M2 and on to L. I suspect that when you login to M2, it's not initializing your keys / starting a full session because the graphical login process did not occur along with all of it's side-effects.

If you want to forward your agent anywhere you ssh, you should create file ~/.ssh/config and add an entry for the * host with ForwardAgent set to yes:

Host *
    ForwardAgent yes

Additionally, you can be more specific about what host you want to forward your agent to by replacing that * with a hostname.

  • So how can you initialize the keys and start a full session when ssh'ing into M2? – Jesse Beder Dec 20 '10 at 0:23
  • In Linux / Solaris I'd start up an ssh-agent and ssh-add all my private keys. Though in general, you don't want to do that. You start your ssh-agent up on your machine and use agent forwarding. That makes it so you don't need to have your sensitive private keys on disk on all your machines. You can try ssh-add -l (it may prompt for a passphrase) – mkomitee Dec 21 '10 at 6:09

You're trying to log into L from M2. That means M2 must have your credentials (key and passphrase). But your credentials are actually on M1.

You can copy your credentials to M2, but then you'd have to interact with the keychain on M2. Alternatively, you can tell M2 to contact the keychain on M1 rather than the keychain on M2. This is in fact the usual method, and some installations have this working out-of-the-box, but apparently not yours.

Enable agent forwarding from M1 to M2. On the command line, with OpenSSH, pass the -A option (i.e. run ssh -A M2 on M1). You can also put the ForwardAgent directive in ~/.ssh/config. Maybe there's a also GUI way to do this on OSX.

  • But I already can log into L from M2 (see the second bullet point), but only when I'm physically on M2. That's what's so confusing to me. (By the way, the -A option does work, but I'd like to figure out why the keychain doesn't work like I'd expect.) – Jesse Beder Dec 19 '10 at 21:31
  • @Jesse: When you're on M2, your credentials in the keychain on M2 are unlocked and available to the ssh process. When you're on M1, only the keychain on M1 is unlocked. I'm not familiar with Macs, so I don't know if there's a way to unlock M2's keychain when you're physically on M1, but I seem to recall reading that it's either impossible or difficult. – Gilles 'SO- stop being evil' Dec 19 '10 at 21:41
  • Why aren't M2's credential's unlocked when I ssh into it? Is there a way to make it effectively as though I'm on M2, even though I'm physically at M1? – Jesse Beder Dec 20 '10 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.