View source for Use the Apple Keychain for ssh key passphrases

== Introduction ==

On macOS, you can set up such that your encrypted ssh keys get automatically decrypted using the passphrase stored in the Apple Keychain, which is unlocked at login.

== How to ==

=== Add your passphrase to the Keychain ===

Create your keys as usual, then do this ''once'' for every key:

 ssh-add --apple-use-keychain ~/.ssh/id_ed25519

'''You ''must'' use the full path your key, a relative path ''will not'' work!'''

=== Configure ssh to use the Keychain to unlock your keys ===

Use this <code>~/.ssh/config</code>:

 Host *
    IgnoreUnknown UseKeychain
    UseKeychain yes

<code>IgnoreUnknown</code> is there so this config will work with non-Apple ssh implementations. You do not need to use '''ssh-agent(1)''', or enable any special Apple-specific options for the ssh agent, ignore the Internet misinformation. Of course you can do this per-host, or per-key, but then <code>IgnoreUnknown</code> should come early in your configuration, before any use of <code>UseKeychain</code>.

== References ==

* [https://apple.stackexchange.com/questions/48502/how-can-i-permanently-add-my-ssh-private-key-to-keychain-so-it-is-automatically How can I permanently add my SSH private key to Keychain so it is automatically available to ssh?]
* [https://developer.apple.com/library/archive/technotes/tn2449/_index.html Technical Note TN2449: OpenSSH updates in macOS 10.12.2]