Use Mac OS X keychain

[jzwolak]

Add support for using the Mac OS X keychain for storing the passphrase. Apple's OpenSSH implementation supports this and something like this used to work with sshj (read: I didn't have to enter my passphrase), but now I have to enter my passphrase every time I make a connection.

I have Mac OS High Sierra 10.13.1.

[guw]

This could be the related to the app you are using. I'm investigating a similar issue in Eclipse (which doesn't use sshj but jsch). Is the passphrase dialog provided by sshj or the application embedding sshj?

[jzwolak]

Almost certainly by sshj. Here's why I think that... the program is Gradle and it's doing an automated build and deploy of my code. In Gradle I have custom tasks for uploading my code to a server using sshj. Sshj is called from Gradle, but by the custom task I wrote. So Gradle wouldn't likely know anything about sshj and I certainly didn't prompt for a passphrase. Therefore, the prompt must be coming from sshj.

The prompt shows up in a dialog window with a textbox. This window appears for every connection... even when I close the connection and create another one to the same server with the same key within the same Gradle task.

[hierynomus]

What I think you're facing is the SSH_AGENT. This is something that the OS uses to unlock the keychain if it is locked and a passphrase isn't provided. This is not something SSHJ provide(d) out of the box.

[hierynomus]

@jzwolak Does that answer your question?

[jzwolak]

No.

I don't think SSHJ is properly interfacing with any SSH_AGENT and this is why SSHJ is prompting me for the passphrase of my ssh keys. It does so every time... even on the same instance where multiple connections are made. In other words, it doesn't even remember the passphrase previously entered despite the program having not exited.

I'm using SSHJ from within Gradle.

I didn't have these problems a couple years back. Probably not even year back.

Jason

-- Jason Zwolak

On Tue, Jan 23, 2018 at 1:15 PM, Jeroen van Erp notifications@github.com wrote:

@jzwolak https://github.com/jzwolak Does that answer your question?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/hierynomus/sshj/issues/383#issuecomment-359881105, or mute the thread https://github.com/notifications/unsubscribe-auth/AARcHclVoSPtUvyKcP_RvsKjSTQtKdbKks5tNiHWgaJpZM4Qk6K2 .

[hierynomus]

@jzwolak I'm very certain indeed SSHJ does no agent interfacing by itself. Please read for instance http://rabexc.org/posts/using-ssh-agent where the concept of ssh-agent is explained.

ssh, and all its friends (including git, rsync, scp...) will just magically use your agent friend when you try to ssh somewhere. Convenient, isn't it?

Same holds for a program that is backed by sshj, the moment it opens the keyfile, the ssh-agent will intercept and enter the passphrase for you.

sshj itself has no capabilities that generate a textbox asking you for your passphrase.

[jzwolak]

Hi Jeroen,

Thanks for the information. From your suggestions I did a Google search and found this blog post: https://blog.elao.com/en/tech/ssh-agent-does-not-automatically-load-passphrases-on-the-osx-sierra-keychain/

And added the "ssh-add" lines to my .profile. This worked for me, even after a reboot. I no longer have to enter my passphrase.

So it seems this was related to the upgrade to High Sierra or Sierra, which was my first guess and I remember trying solutions for those upgrades 6-12 months ago. They didn't work, but the one above does.

I apologize for taking your time and do appreciate that you actually took the time. Can I buy you a cup of coffee or make a donation to your work to show my appreciation?

-- Jason Zwolak

On Wed, Jan 24, 2018 at 3:24 PM, Jeroen van Erp notifications@github.com wrote:

@jzwolak https://github.com/jzwolak I'm very certain indeed SSHJ does no agent interfacing by itself. Please read for instance http://rabexc.org/posts/using-ssh-agent where the concept of ssh-agent is explained.

ssh, and all its friends (including git, rsync, scp...) will just magically use your agent friend when you try to ssh somewhere. Convenient, isn't it?

Same holds for a program that is backed by sshj, the moment it opens the keyfile, the ssh-agent will intercept and enter the passphrase for you.

sshj itself has no capabilities that generate a textbox asking you for your passphrase.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/hierynomus/sshj/issues/383#issuecomment-360261924, or mute the thread https://github.com/notifications/unsubscribe-auth/AARcHVY13xxpoYFp3Ii1S-38LpqtiB_Eks5tN5F7gaJpZM4Qk6K2 .

[hierynomus]

Hi @jzwolak,

No problem, glad you got it solved! Shoot me a private mail to chat further (email is in my GH profile).