Reputation: 11239

SSH Key - Still asking for password and passphrase

I've been somewhat 'putting up' with GitHub always asking for my username and password when I clone a repository. I want to bypass this step because it is an annoyance within my workflow.

I tried setting up an SSH key (which I successfully did) using this guide. https://help.github.com/articles/generating-ssh-keys and I was successful.

My problem is that I am still asked for my GitHub password and passphrase when cloning a repository (using SSH). My understanding was that after I set up this SSH key, I would no longer have to do that.

I want to be able to clone repositories without having to put in my GitHub information all the time.

What am I missing with my SSH key? If anyone can provide some guidance or resources I would appreciate it, because I've always felt a little lost when it came to SSH authentication in GitHub.

From my knowledge, this is a command that tests if things are working properly, here are the output from my console:

~ $ ssh -T [email protected]
Saving password to keychain failed
Enter passphrase for key '/Users/MYNAME/.ssh/id_rsa':
Hi MYNAME! You've successfully authenticated, but GitHub does not provide shell access.

When I input my password, should that fail first? Then, when I enter my passphrase, it passes.

Upvotes: 874

Answers (30)

Sumit

Reputation: 24

MAC - ssh-add

You just need to do SSH ADD it will automatically update

Upvotes: 0

tumelo dlodlo

Reputation: 11

Automate "Simple and repeatable deployment processes"

Solution follows these answers. Assumes you have setup pass locally and generated ssh keys locally. And your passphrase for your ssh keys is stored in pass at entry "github.com/ssh". And you are not using ssh-add. View your password on the command line like this:

   pass show github.com/ssh

Depending on our preference. If pass asks your for a password then setup pass to not ask you for a password.

Automate git ssh authentication prompts using:

expect "to automate control of interactive applications"
pass password manager

Create and put inside file: main.sh

    #! /bin/bash

    # main entry point for program:
    #+  Automate interactive steps

    # depends on expect
    #+  @see Expect https://en.wikipedia.org/wiki/Expect
    #+  @see Linux expect Command With Examples https://phoenixnap.com/kb/linux-expect
    which expect \
        || sudo apt install expect 

    # automatically interact with git ssh passphrase prompt
    ./automatically_interact_with_git_ssh.expect "$(pass show github.com/ssh)"

Create and put inside file: automatically_interact_with_git_ssh.expect Repalce USERNAME with your linux username. Replace id_ed25519 with your ssh private key filename.

    #!/usr/bin/expect

    # get the password
    set passphrase [lindex $argv 0]

    # validate
    #+  the password has a value
    if { $passphrase == "" } {
        puts "The passphrase is required.\n"
        exit 1
    }

    # run interactive git program
    spawn ./interactive_git_program.sh

    # automatically answer the interactive program's passphrase question
    expect "Enter passphrase for key '/home/USERNAME/.ssh/id_ed25519':\r"
    send -- "$passphrase\r"
    expect eof

Create and put inside file: interactive_git_program.sh Replace your USERNAME and REPOSITORY from github.com repo.

    #! /bin/bash

    # replace your USERNAME and REPOSITORY
    git clone [email protected]:USERNAME/REPOSITORY.git
    # git clone [email protected]:nlohmann/json.git

    # do other "simple and repeatable deployment processes"

Make the files you created executable. On the bash command line run:

    chmod u+x \
        main.sh \
        automatically_interact_with_git_ssh.expect \
        interactive_git_program.sh

Run the app on the command bash line:

    ./main.sh

Upvotes: 0

Hareen Laks

Reputation: 1505

I had the same issue and this was my solution.

First check the OpenSSH version in your computer.

ssh -V

If it is greater than 8.8, Then check whether your keys's type is RSA.

ssh-keygen -l -f ${PATH_TO_KEY}

If it says, RSA like below you are in trouble.

3072 SHA256:SSH_KEY_FINGERPRINT YOUR_NAME@YOUR_HOST (RSA)

Because the greater OpenSSH versions than 8.8 do not accept the RSA keys. So generate and use Ed25519 keys as below.

ssh-keygen -t ed25519

Upvotes: 1

ChrisJF

Reputation: 7190

I tried all the answers here and none of these answers worked! My password would not persist between sessions/restarts of my Mac.

What I found out from reading this OpenRadar and this Twitter discussion was that Apple purposely changed the behaviour for ssh-agent in macOS 10.12 Sierra to no longer automatically load the previous SSH keys. In order to maintain the same behaviour as El Capitan I did the following:

ssh-add --apple-use-keychain ~/.ssh/id_rsa

Note: change the path to where your id_rsa key is located. Also, --apple-use-keychain was previously -K.

ssh-add --apple-load-keychain

Note: --apple-load-keychain was previously -A.

Create (or edit if it exists) the following ~/.ssh/config file:

 Host *
   UseKeychain yes
   AddKeysToAgent yes
   IdentityFile ~/.ssh/id_rsa

And now my password is remembered between restarts of my Mac!

Upvotes: 210

Dmytro Yashchenko

Reputation: 921

I creation ssh key, added it to ssh agent, added it to my github profile. All according to github official instructions. BUT connection didn't establish. I fixed it by calling ssh -T [email protected] in terminal. Then I got message "Permanently added 'github.com' (ED25519) to the list of known hosts". And all started to work!

Upvotes: 1

Simon Boudrias

Reputation: 44589

If you work with HTTPs urls, it'll always ask for your username / password. This could be solved using @Manavalan Gajapathy's comment (copying here):

See this github doc to convert remote's URL from https to ssh. To check if remote's URL is ssh or https, use git remote -v. To switch from https to ssh:

git remote set-url origin [email protected]:USERNAME/REPOSITORY.git

If you're correctly using SSH when cloning / setting remotes: make sure you have a ssh-agent to remember your password (see this answer by @Komu). That way, you'll only enter your passphrase once by terminal session.

If it is still too annoying, then simply set a ssh-key without passphrase.

Upvotes: 462

Marina

Reputation: 1780

If you're using windows, this worked for me:

eval `ssh-agent -s`
ssh-add ~/.ssh/*_rsa

It'll ask for passphrase in the second command, and that's it.

Add these lines to your bash profile, $HOME/.bash_profile or $HOME/.bashrc.

Upvotes: 21

Komu

Reputation: 14998

Add Identity without Keychain

There may be times in which you don't want the passphrase stored in the keychain, but don't want to have to enter the passphrase over and over again.

You can do that like this:

ssh-add ~/.ssh/id_rsa

This will ask you for the passphrase, enter it and it will not ask again until you restart.

Add Identity Using Keychain

As @dennis points out in the comments, to persist the passphrase through restarts by storing it in your keychain, you can use the --apple-use-keychain option (-k for Ubuntu) when adding the identity like this:

ssh-add --apple-use-keychain ~/.ssh/id_rsa

Once again, this will ask you for the passphrase, enter it and this time it will never ask again for this identity.

Upvotes: 1225

CM777

Reputation: 450

This page on github has the answer you need. You have to switch to ssh authentication from https.

Check how it is authenticating as follows.

$ git remote -v
> origin  https://github.com/USERNAME/REPOSITORY.git (fetch)
> origin  https://github.com/USERNAME/REPOSITORY.git (push)

Change your remote's URL from HTTPS to SSH with the git remote set-url command.

$ git remote set-url origin [email protected]:USERNAME/REPOSITORY.git

Test it again with

$ git remote -v
# Verify new remote URL
> origin  [email protected]:USERNAME/REPOSITORY.git (fetch)
> origin  [email protected]:USERNAME/REPOSITORY.git (push)

That's all. It will work now.

Upvotes: 25

Junaid

Reputation: 4926

TL;DR
You need to use an ssh agent. To do that, open terminal & before pushing to git, execute
ssh-add
enter your passphrase when prompted.

Check out the original StackExchange answer here

Upvotes: 58

Mohammad Yahia

Reputation: 513

The way that worked for me (windows 10)

open git-gui from applications
help
show ssh-keys
generate ssh-key
copy ssh key to git provider

This way we guarantee that git client is pointing to the valid ssh

Upvotes: 1

yebowhatsay

Reputation: 341

Adding to the above answers. Had to do one more step on Windows for git to be able to use ssh-agent.

Had to run the following command in powershell to update the environment variable:

PS> [Environment]::SetEnvironmentVariable("GIT_SSH", "$((Get-Command ssh).Source)", [System.EnvironmentVariableTarget]::User)

Restart VSCode, Powershell or whatever terminal you are using to activate the env variable.

Complete instructions can be found [here] (https://snowdrift.tech/cli/ssh/git/tutorials/2019/01/31/using-ssh-agent-git-windows.html).

Upvotes: 3

chaosifier

Reputation: 2964

This answer is primarily for windows users and also equally relevant if you're having trouble cloning with tfs, github or gitlab on any other OS.

The default authentication mode when using SSH is the private key. Whenever that fails for some reason, the ssh-agent falls back to username and password based authentication.

There are several reasons why the default key based authentication might have failed. Following are the most common cases :

a) The ssh-agent cannot find the default private key file which is id_rsa, and no other key path is specified explicitly.

b) The public key stored in the server is incorrect.

c) The path you're trying to clone is incorrect.

In any case, to troubleshoot the issue, first of all execute the git clone command with verbose logging with the command :

GIT_TRACE=1 GIT_SSH_COMMAND="ssh -vvv" git clone ssh://pathToYourRepo

You can go through each step in the log to get an intuition of what the issue might be.

Troubleshooting in case of (a)

Make sure you have the default key name id_rsa in the .ssh directory. You might have specified some different keyname when generating the key with ssh-keygen command or maybe there isn't any key at all).
In case you want to specify a different key for authentication, use the following command :
```
 ssh-agent bash -c 'ssh-add ~/.ssh/anotherKey; git clone ssh://pathToYourRepo'
```

Troubleshooting in case of (b)

Make sure there aren't extra white spaces when storing the public key in the server.

Troubleshooting in case of (c)

Make sure you aren't trying to clone with the https version of the repository path.

Upvotes: 7

possumkeys

Reputation: 546

Use ssh-add command to add your public key to the ssh-agent.

ssh-add

Make sure the ssh public key e.g. ~/.ssh/id_rsa.pub is what you have in your repo settings.

Make sure you can actually ssh into the server e.g. For Bitbucket:

ssh -T [email protected]

Update the url to move from https to ssh. You can check which you use by checking the output of:

git remote -v

If you see a https:// in the urls, then you are still using https. To update it: Take the url and just replace https:// with ssh:// e.g. Change:

https://[email protected]/../..

To:

ssh://[email protected]/../..

Referenced: https://docs.github.com/en/github/using-git/changing-a-remotes-url#switching-remote-urls-from-https-to-ssh

Upvotes: 14

James Bond

Reputation: 2966

If you used for your GIT the password authentication before, but now are using SSH authentication, you need to switch remote URLs from HTTPS to SSH:

git remote set-url origin [email protected]:USERNAME/REPOSITORY.git

Upvotes: 7

Onat Korucu

Reputation: 1032

As explained in Cloning a Git repo from VSTS over SSH asks a password! Unexpected

The problem may be because of public key authentication failing, so it then asks for mycompany account's password.

This would not happen if the public key authentication succeeded.

So you might check id_rsa.pub and even create a new one.

Upvotes: 1

PavDub

Reputation: 181

SSH Key - Still asking for password and passphrase

If on Windows and using PuTTY as the SSH key generator, this quick & easy solution turned out to be the only working solution for me using a plain windows command line:

Your PuTTY installation should come with several executable, among others, pageant.exe and plink.exe
When generating a SSH key with PuttyGen, the key is stored with the .ppk extension
Run "full\path\to\your\pageant.exe" "full\path\to\your\key.ppk" (must be quoted). This will execute the pageant service and register your key (after entering the password).
Set environment variable GIT_SSH=full\path\to\plink.exe (must not be quoted). This will redirect git ssh-communication-related commands to plink that will use the pageantservice for authentication without asking for the password again.

Done!

Note1: This documentation warns about some peculiarities when working with the GIT_SHH environment variable settings. I can push, pull, fetch with any number of additional parameters to the command and everything works just fine for me (without any need to write an extra script as suggested therein).

Note2: Path to PuTTY instalation is usually in PATH so may be omitted. Anyway, I prefer specifying the full paths.

Automation:

The following batch file can be run before using git from command line. It illustrates the usage of the settings:

git-init.bat
   @ECHO OFF
   :: Use start since the call is blocking
   START "%ProgramFiles%\PuTTY\pageant.exe" "%HOMEDRIVE%%HOMEPATH%\.ssh\id_ed00000.ppk"
   SET GIT_SSH=%ProgramFiles%\PuTTY\plink.exe

Anyway, I have the GIT_SSH variable set in SystemPropertiesAdvanced.exe > Environment variables and the pageant.exe added as the Run registry key (*).

(*) Steps to add a Run registry key>

run regedit.exe
Navigate to HKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Run
Do (menu) Edit > New > String Value
Enter an arbitrary (but unique) name
Do (menu) Edit > Modify... (or double-click)
Enter the quotes-enclosed path to pageant.exe and public key, e.g., "C:\Program Files\PuTTY\pageant.exe" "C:\Users\username\.ssh\id_ed00000.ppk" (notice that %ProgramFiles% etc. variables do not work in here unless choosing Expandable string value in place of the String value in step 3.).

Upvotes: 2

daniel sp

Reputation: 1000

This is what worked for me:

git config --global core.sshCommand "'C:\Windows\System32\OpenSSH\ssh.exe'"

Upvotes: 13

Black

Reputation: 20202

I had to execute:

eval `ssh-agent -s`
ssh-add

Note: You will have to do this again after every restart. If you want to avoid it, then enter it in your ".bashrc" file which is in C:\Users\<<USERNAME>>\.bashrc on windows. It is probably hidden, so make sure that you can see hidden files.

Solution found here.

Upvotes: 29

aboutaaron

Reputation: 5389

I recently upgraded to macOS Mojave, and installed some tools via homebrew, which seemed to swap Apple's version of ssh-add for the different one. My default version of ssh-add did not have the -K option. This led to the following error:

# ssh-add: illegal option -- K

You can see which version of ssh-add you have by running which ssh-add.

(Mine was stored in /usr/local/bin/ssh-add)

To fix this, I had to point the key to Apple's version:

/usr/bin/ssh-add -K ~/.ssh/id_rsa

Git/GitHub worked perfectly afterward. For more information, see: Error: ssh-add: illegal option -- K

Upvotes: 7

DhineshYes

Reputation: 1088

Worked in LinuxMint/Ubuntu

Do the following steps

Step 1:

Goto file => /.ssh/config

Save the below lines into the file

Host bitbucket.org
    HostName bitbucket.org
    User git
    IdentityFile /home/apple/myssh-privatekey
    AddKeysToAgent yes

Don't forget to add this line AddKeysToAgent yes

Step 2:

Open the terminal and add the keyset to the ssh-add

$ ssh-add -k /home/apple/myssh-privatekey

provide the passphrase.

Upvotes: 8

Groot

Reputation: 14251

On Mac OSX you can add your private key to the keychain using the command:

ssh-add -K /path/to/private_key

If your private key is stored at ~/.ssh and is named id_rsa:

ssh-add -K ~/.ssh/id_rsa

You will then be prompted for your password, which will be stored in your keychain.

Edit - Handle restart

In order to not have to fill in your password even after a restart add the following to your ssh configuration file (commonly located at ~/.ssh/config)

Host *
  UseKeychain yes
  AddKeysToAgent yes
  IdentityFile ~/.ssh/id_rsa

Upvotes: 304

Anang Satria

Reputation: 1286

Generally, here are the steps to allow you make a remote connection to your server using ssh without password:

Create a pair of rsa private and public key

$ ssh-keygen -t rsa -b 4096 -C "your comments"

Copy your public key and login to your remote server
Add your public key to .ssh/authorized_keys
If you have multiple ssh keys in your computer you might to add your key using ssh-add

$ ssh-add /path/to/private/key
Then try ssh to your server

$ ssh username@your_ip_address

Source: http://diary-of-programmer.blogspot.com/2018/08/tips-how-to-ssh-to-your-digitalocean.html

Upvotes: 2

Amir Heshmati

Reputation: 648

Mobaxterme had a UI interface for it

setting > configuration > SSH > SSH Agent > [check] Use internal SSH agent "moboAgent" > add [your id_rsa and restart mobaxterme to set changes]

Upvotes: 1

Bruno Leite

Reputation: 68

Same problem to me and the solution was:

See this github doc to convert remote's URL from https to ssh. To check if remote's URL is ssh or https, use git remote -v. To switch from https to ssh: git remote set-url origin [email protected]:USERNAME/REPOSITORY.git @jeeYem

Upvotes: 1

Fabian Stern

Reputation: 386

If you are using Windows and GIT without third party tools and your key is not secured by a password / passphrase use this:

Environment Variable HOME must be set to your user profile (e.g. C:\Users\Laptop)
Go to C:\Users\Laptop\.ssh\ folder and edit "config" file (or create the file!) Example: C:\Users\Laptop.ssh\config (note: there is no . at the end!)

Add your git-server host to the "config" file like so:

#Example host entry
Host myhostname.com
    HostName myhostname.com
    User git
    IdentityFile c:/users/laptop/.ssh/id_rsa.pub
    PasswordAuthentication no
    Port 422

Save the file and clone the repository like this:

git clone ssh://myhostname.com/git-server/repos/picalc.git

You can use additional configuration parameters for the "config" file host entry. These can be found in your local git installation folder, e.g. "C:\Program Files\Git\etc\ssh\ssh_config". Excerpt:

# Host *
#   ForwardAgent no
#   ForwardX11 no
#   RhostsRSAAuthentication no
#   RSAAuthentication yes
#   PasswordAuthentication yes
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   IdentityFile ~/.ssh/id_ecdsa
#   IdentityFile ~/.ssh/id_ed25519
#   Port 22
#   Protocol 2
#   Cipher 3des
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
#   MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
#   ProxyCommand ssh -q -W %h:%p gateway.example.com
#   RekeyLimit 1G 1h

Upvotes: 1

Lerner Zhang

Reputation: 7130

I'd like to add an answer for those who may still need to enter the password because they have set IdentitiesOnly as yes. This may cause by multiple keys and the identity file, being keys for git or server.

After I have generated the key and copied it to the server:

ssh-keygen
ssh-copy-id -i ~/.ssh/12gpu_server.pub [email protected]

I found it didn't work.

Then I went to check the ~/.ssh/config file, I saw this at the bottom:

Host *
IdentitiesOnly yes

Then I add this above:

Host 12gpu
HostName 192.168.20.160
User lerner
IdentityFile ~/.ssh/12gpu_server

I can just log in by entering ssh 12gpu.

Then you can add multiple ssh keys using your favorite names, and you only need to add the settings like the above four lines to the config file.

Host is the name you'd like to enter when you connect to the server later; the HostName is the server's ip or domain like github.com; User is the user name you log in the server like the user name or git for github or gitlab; and the IdentityFile is the file where you store the key you have generated.

Upvotes: 1

Bryan Perez

Reputation: 61

Problem seems to be because you're cloning from HTTPS and not SSH. I tried all the other solutions here but was still experiencing problems. This did it for me.

Using the osxkeychain helper like so:

Find out if you have it installed.

git credential-osxkeychain
If it's not installed, you'll be prompted to download it as part of Xcode Command Line Tools.
If it is installed, tell Git to use osxkeychain helper using the global credential.helper config:

git config --global credential.helper osxkeychain

The next time you clone an HTTPS url, you'll be prompted for the username/password, and to grant access to the OSX keychain. After you do this the first time, it should be saved in your keychain and you won't have to type it in again.

Upvotes: 2

Lost Koder

Reputation: 884

Use ssh remote url provided by Github not https.

Upvotes: 2

Mahtab Alam

Reputation: 1870

Make sure you are using ssh for your repository also

mahtab@mahtab-Lenovo-G50-70:~/my-projects/jenkins-cje-2017$ git remote -v origin [email protected]:eMahtab/jenkins-cje-2017.git (fetch) origin [email protected]:eMahtab/jenkins-cje-2017.git (push)

Don't use https, if your remote is using https then it will keep asking for password, even If you have added the public key to Github and added private key to ssh-agent. Below will always ask for password

mahtab@mahtab-Lenovo-G50-70:~/my-projects/jenkins-cje-2017$ git remote -v origin https://github.com/eMahtab/jenkins-cje-2017.git (fetch) origin https://github.com/eMahtab/jenkins-cje-2017.git (push)

Upvotes: 44

SSH Key - Still asking for password and passphrase

Answers (30)

Add Identity without Keychain

Add Identity Using Keychain

Related Questions