How to keep the SSH private key passphrase away from OSX

keychainSecuritysshterminal

I recently created an SSH public/private keypair on my Mac OSX Yosemite system and for this use-case, I wanted to encrypt the private key with a passphrase.

However, the first time I attempted to use this key, I was surprised to see a GUI component overlay itself over my terminal … that is the first time I had ever seen (or heard of) keychain.

I want nothing to do with this. I want the passphrase to exist nowhere but my own head – not even in an encrypted or keychain-vaulted safe space.

So I learned about the ssh config option 'AskPassGUI no' and that seems to have solved my problem. I use that ssh key and keychain seems to not be invoked and there are no GUI pop-ups, etc.

But I'm suspicious … I never liked that little Unicode key character that the Mac terminal inserts into the passphrase dialog in the terminal – it makes me think there are processes or services overlaying the terminal.

My question:

With AskPassGUI set to no, and no sign of keychain popping up, am I saving/caching/storing either my key, or my passphrase … or anything … inside OSX ?

Or am I having the simple, basic, text only relationship with my terminal that I hope to be having ?

Thanks.

Best Answer

I have no inside information about the MacOS internals, but from my experience using this feature, the passphrase is accepted by the GUI only to add the corresponding key to an ssh-agent. On my system it did not store the passphrase in the keychain (which I also do not want), but I'm not sure that's default behavior. My terminal would report "saving to keychain failed", but I could then ssh using that key until I logged out / restarted. See the "AskPassGUI" and "KeychainIntegration" options in ssh_config (superseded in more recent MacOS versions, though). Because it did not save the passphrase in the keychain, I happily entered my passphrase only once a week (shutting down on the weekend and never logging out).

Related Solutions

Password dialog appears when SSH private key permissions are set to 0600

Make sure you have a corresponding id_rsa.pub or id_dsa.pub in your ~/.ssh directory.

When I had an id_rsa but not a corresponding id_rsa.pub, Mac OS X kept popping up the dialog and remember passowrd in my keychain did nothing.

cd ~/.ssh
ssh-keygen -y -f id_rsa > id_rsa.pub

generated the appropriate public key file for me.

If you already had your public file there (rename it to another name) and generate the public key again using the above command, you'll notice that the generated and the old one are not equal. Somehow the older versions of Mac OS X generated a public key that Lion does not like anymore, generating it again fixes that.

For the curious, the key is exactly the same, the part that changes is that there is no "comments" section after the key on the file any longer.

Password dialog appears for password-less SSH private key

I had this same problem. However, when a generated a new password-less private key, using the following command:

ssh-keygen -b 1024 -t rsa -f id_rsa -P ""

I no longer saw the password prompt.

Additionally, ssh-add failed to add the old key, but added the new one as expected.

I generated the old key on Leopard in 2009, using what ever version of OpenSSL I had grabbed, built and installed back then (that Mac died, so I can't log in and check what I was running). Something about that key was incompatible with Lion's native SSL libraries.

I backed up my old key, so if anyone wants to suggest some checks, to identify the key's specific properties, let me what to check and I'll report back.

Another clue - I noticed that my old id_rsa.pub file had extended attributes. i.e. it's permissions flags looked like this r--------@ instead of r--------

xattr -l id_rsa.pub.old

returned:

com.macromates.caret: {
    column = 0;
    line = 1;
}

cruft left over from TextMate. I don't know if removing it would have fixed the issue without my having to replace the key. I think it's unlikely.

In case you (future reader) are seeing the same thing, you can remove the extended attribute as follows:

 xattr -d com.macromates.caret id_rsa.pub.old

You can stop TextMate from adding them by first exiting TextMate and then issuing this command:

defaults write com.macromates.textmate OakDocumentDisableFSMetaData 1

Best Answer

Related Solutions

Password dialog appears when SSH private key permissions are set to 0600

Password dialog appears for password-less SSH private key

Related Question