Leopard SSH/Keychain integration - how?

Question

Level 1

5 points

Leopard SSH/Keychain integration - how?

When I upgraded my old MacBook Pro to Leopard, one of the first things I noticed as somebody who spends a lot of time on the terminal, is that Leopard runs its own ssh-agent which prompts you for SSH key passphrases and stores them in the OSX keychain. Great, I no longer need to run SSHKeychain.

The problem is, I've just bought a brand new MacBook which of course comes with Leopard pre-installed - and now this doesn't happen. Whenever I try to ssh into a server using a public key, it always prompts me to enter the passphrase (in the shell, not an OSX prompt). What happened to Leopard prompting me for the password so it can store it in the keychain?

Am I missing something here? I've done as much googling as possible on the subject and I can't find any answers. I can confirm that Leopard has started up ssh-agent by running:

$ ps aux | grep ssh-agent | grep -v grep

I can also confirm that it has set the SSH AUTHSOCK environment variable:

$ echo $SSH AUTHSOCK
/tmp/launch-3soUTV/Listeners

Any ideas?

Posted on Mar 3, 2008 1:11 PM

Reply

Answer 1

arri

Level 1

1 points

Mar 3, 2008 1:41 PM in response to Luke Redpath

i'm not sure i understand the problem, but i also never used (needed ?) SSHKeyChain..

did you try generating a new keys and clearing the old from known_hosts on the remote machine?

Reply

Answer 2

Mar 3, 2008 2:04 PM in response to arri

You need to generate a new keypair and put the public one in .ssh/authorized_keys on the server.
From the ssh man page:
"The file ~/.ssh/authorized_keys lists the public keys that are permitted for logging in.
When the user logs in, the ssh program tells the server which key pair it would like to use
for authentication. The client proves that it has access to the private key and the server
checks that the corresponding public key is authorized to accept the account.

The user creates his/her key pair by running ssh-keygen(1). This stores the private key in
~/.ssh/identity (protocol 1), ~/.ssh/id_dsa (protocol 2 DSA), or ~/.ssh/id_rsa (protocol 2
RSA) and stores the public key in ~/.ssh/identity.pub (protocol 1), ~/.ssh/id_dsa.pub (pro-
tocol 2 DSA), or ~/.ssh/id_rsa.pub (protocol 2 RSA) in the user's home directory. The user
should then copy the public key to ~/.ssh/authorized_keys in his/her home directory on the
remote machine. The authorized_keys file corresponds to the conventional ~/.rhosts file,
and has one key per line, though the lines can be very long. After this, the user can log
in without giving the password."

AK

Reply

Answer 3

Luke Redpath Author

Level 1

5 points

Mar 3, 2008 2:49 PM in response to Austin Kinsella1

There isn't actually wrong with my keys. I've already added the public key to the remote authorized_keys file. I can ssh in after entering the passphrase for the key. The problem is that every time I ssh in it prompts me for my passphrase. In Leopard, an OSX security dialog is supposed to pop up instead of the normal passphrase prompt, asking me to enter my passphrase with a check box to store it in the keychain. However this isn't happening and I cannot work out why.

Reply

Answer 4

Luke Redpath Author

Level 1

5 points

Mar 3, 2008 3:28 PM in response to Luke Redpath

I suddenly had a brainwave and a quick "which ssh" made it immediately clear what the problem is. I have installed several packages using MacPorts, one of which installed OpenSSH as a dependency. This resulted in a different installation of ssh in /opt/local/bin which was the binary that was being used. When I run the built-in ssh in /usr/bin the Leopard prompt appears. Woohoo!

Reply

Answer 5

Mar 3, 2008 6:23 PM in response to Luke Redpath

Are you saying the MacPorts build of SSH is integrated with Keychain?

Reply

Answer 6

Luke Redpath Author

Level 1

5 points

Mar 4, 2008 11:33 AM in response to Gnarlodious

No, the Leopard built-in build of SSH supports Keychain integration. See:

http://www.ormset.no/wordpress/2007/10/28/leopard-finally-supporting-ssh-agent-a t-login/

The MacPorts build of OpenSSH is a standard build with no keychain support, and because /opt/local/bin was first in my path, before /usr/bin, I was using the MacPorts build without realising (which I was why I couldn't get the Keychain integration to work!). I renamed the MacPorts binary to ssh2 and all is well.

Reply

Answer 7

Apr 17, 2008 11:54 AM in response to Luke Redpath

I have also the same problem.
(still need to enter my password within the terminal, so no Leopard popup 😟 )
Any hints to solve this ?

Reply

Answer 8

May 11, 2008 11:48 AM in response to pieter_degraeuwe

Deactivating openssh in MacPorts solved this problem for me! The Keychain integration only seems to work with the built in SSH version.

With best regards
Rodrigo

Reply

Answer 9

matteth

Level 1

0 points

Jun 10, 2008 12:48 AM in response to Luke Redpath

I have the same problem - keychain integration worked at first, now it doesn't.
I do have MacPorts installed, but no ssh in /opt/local/bin, and "which ssh" answers /usr/bin.

But, no keychain integration. Leopard 10.5.3.

Any clues?

Thanks /Mats

Reply