Use the Apple Keychain for ssh key passphrases

Introduction

On macOS, you can set up such that your encrypted ssh keys get automatically decrypted using the passphrase stored in the Apple Keychain, which is unlocked at login.

How to

Add your passphrase to the Keychain

Create your keys as usual, then do this once for every key:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

You must use the full path your key, a relative path will not work!

Configure ssh to use the Keychain to unlock your keys

Use this ~/.ssh/config:

Host *
   IgnoreUnknown UseKeychain
   UseKeychain yes

IgnoreUnknown is there so this config will work with non-Apple ssh implementations. You do not need to use ssh-agent(1), or enable any special Apple-specific options for the ssh agent, ignore the Internet misinformation. Of course you can do this per-host, or per-key, but then IgnoreUnknown should come early in your configuration, before any use of UseKeychain .

References

• How can I permanently add my SSH private key to Keychain so it is automatically available to ssh?
• Technical Note TN2449: OpenSSH updates in macOS 10.12.2