184

I am trying to set up my ssh config on the Mac (Mac OS Sierra 10.12.6) in such a way that it stores the passphrase for my ssh key in the keychain. Previously I could do that with

ssh-add -K ~/.ssh/id_rsa

But recently this doesn't seem to work anymore. Following this article there seems to be a change in the behaviour of the ssh config in Mac OS > 10.12.2 and the recommended way to fix this issue is to add UseKeychain yes to your ssh config. So here's my .ssh/config section the Host *:

Host *
  Port 22
  ServerAliveInterval 60
  ForwardAgent yes
  IdentityFile ~/.ssh/id_rsa
  AddKeysToAgent yes
  UseKeychain yes

When trying to ssh to a foreign host, I get the following error message:

$ ssh my-host
/Users/USER/.ssh/config: line 16: Bad configuration option: usekeychain

Any ideas why this happens and how I can fix it? Thanks!

0

9 Answers 9

364

Try to specify another option, namely IgnoreUnknown like below:

Host *
  IgnoreUnknown UseKeychain
  UseKeychain yes

You can find more info about this here.

If you already have an IgnoreUnknown value, use comma separated values

Host *
  IgnoreUnknown AddKeysToAgent,UseKeychain
  AddKeysToAgent yes
  UseKeychain yes

If you have multiple Host configs that use the UseKeychain option, make sure to put

Host *
  IgnoreUnknown UseKeychain

before the first host that uses the the option, e.g. put it at the top of the file.

If you do not want to (or cannot) modify your SSH configuration file, you can also pass this option when connecting on the command line:

ssh -o IgnoreUnknown=UseKeychain my-host
10
  • 2
    Bypass the config file via ssh -F /dev/null ... temporarily, it works for me.
    – Itachi
    Sep 6, 2018 at 14:40
  • 4
    Adding IgnoreUnknown UseKeychain still doesn't work for me, so I remove UseKeychain yes altogether and it works. Not sure this is the best approach though.
    – Hank Chan
    Oct 12, 2018 at 23:51
  • 2
    This solution worked for me but I don't understand why this change all of a sudden ? I am only logging in to my DigitalOcean account.
    – anjanesh
    Feb 18, 2020 at 4:46
  • 8
    Rather than writing "You can find more info about this here.", it would be better to be specific on what the option does and why it would be useful: "If you are sharing your ssh configuration with systems running older versions of OpenSSH that don't understand the UseKeychain option, you can specify the IgnoreUnknown option to keep your configuration compatible with both new and old versions" - developer.apple.com/library/archive/technotes/tn2449/…
    – David J.
    Jun 16, 2021 at 19:06
  • 4
    The Apple docs say that the UseKeychain option was introduced in macOS Sierra 10.12. So why (or under what conditions) does this error occur in macOS Big Sur 11.4?
    – David J.
    Jun 16, 2021 at 19:13
78

The accepted answer helped me but did not completely solve my problem because I had multiple options that were bad. Here is an example of what it might look like if you have this issue:

Host *
  IgnoreUnknown AddKeysToAgent,UseKeychain
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_rsa
3
  • Just want to leave this here: I had trouble remotely connecting as well and this turned out to be the problem. The issue was generated by using Bitbucket's Sourcetree tool, which I have uninstalled but left remnants that prevented remote connection
    – Connor
    Jul 26, 2018 at 16:35
  • Thanks! Worked on MacOS mojave 10.14.6
    – brendan
    Sep 30, 2019 at 22:19
  • 4
    Why does this work? I had the same problem and this answer fixed it, but I still don't know why this worked or why I had the problem in the first place .. May 20, 2020 at 22:08
1

Instead of ssh-add type ‘open .ssh/id_rsa’ and add it to the keychain

The UseKeychain option never appeared as bad on my config, but I have in the beginning, before any other host, the following

Host *
UseKeychain yes 

Host (...)
2
  • 2
    FYI, I think that's the wrong order. If you write it that way, your * rules will be ignored. man ssh_config says, "Since the first obtained value for each parameter is used, more host-specific declarations should be given near the beginning of the file, and general defaults at the end."
    – Telemachus
    May 15, 2020 at 11:14
  • FYI, I've had it like that for almost a decade with dozens of servers and never had an issue. I ssh to so many servers every day. However, if anyone finds a real life issue with that config, maybe that'll be it then. May 18, 2020 at 11:36
1

Just a related note, if your config has multiple Host entries, you should be setting IgnoreUnknown only once at the top of the file - otherwise you get the error Bad configuration option: usekeychain again. For example:

Host *
  IgnoreUnknown UseKeychain
0

I had a similar issue that was solved by removing the leading space in front of the config eg:

Host *
UseKeychain yes

vs

Host *
  UseKeychain yes
0

The accepted answer didn't work for me, I also had to change the host pattern. I followed GitHub's docs and used:

Host *.github.com
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

The suggested fix:

Host *.github.com
  IgnoreUnknown AddKeysToAgent,UseKeychain
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

didn't work. Only after removing the .github.com part did it work:

Host *
  IgnoreUnknown AddKeysToAgent,UseKeychain
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

No idea why.

1
  • Doesn't removing the "github" part though mean that this Host is now defined as "*" (all endpoints)? Mar 13 at 21:49
-1

I just commented out the line and scp/ssh started working for me again.

3
  • 1
    which line? please leave a more meaningful message Apr 5, 2021 at 10:48
  • 2
    The OP writes "Any ideas why this happens and how I can fix it? Thanks!", but this answer doesn't answer the why nor does it provide a fix on how to keep the desired functionality (macOS Keychain integration) without an error.
    – David J.
    Jun 16, 2021 at 19:04
  • 1
    removing UseKeychain and AddKeysToAgent seems to work fine now, and running ssh-add -l yields no identities. not sure why it's working tbh. maybe it won't after a reboot?
    – Eben Geer
    Aug 5, 2021 at 21:46
-1

It's the capital -K try lowercase -k!!

ssh-add -k ~/.ssh/id_rsa

Enter passphrase for /Users/tom/.ssh/id_rsa:
Identity added: /Users/tom/.ssh/id_rsa (/Users/tom/.ssh/id_rsa)
1
  • 2
    ssh-add does have -K option at least on macOS. man ssh-add: -K When adding identities, each passphrase will also be stored in the user's keychain. When removing identities with -d, each passphrase will be removed from it.
    – uasi
    Nov 18, 2019 at 7:42
-1

I had the same issue and i realized that when started to generate the key by following the instructions. The first step is this.

ssh-keygen -t rsa -b 4096 -C "[email protected]"

I didn't change the email address but of course I have forgotten to do that :D. So make sure to not forget that step and all will be fine.

1
  • This is not a generally applicable solution.
    – David J.
    Jun 16, 2021 at 19:00

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.