36

I use ssh on my machine, and have set up a long not-human-friendly passphrase which is saved in my password manager. What makes me crazy every time is that I cannot paste into the window pictured below. I know the Remember password in my keychain option and use it. Sometimes I have to enter a new one though. Why can't I paste into a password field?

Same thing for the dialog which pops up when plugging in encrypted disks.

ssh-agent window

Some updates:

  1. I found out how i can circumvent the dialog: just use ssh-add -K ~/.ssh/id_rsa, and then I can paste the passphrase into the terminal.
  2. As mattmcmanus mentioned, my Key is encryted using pkcs8 which was broken on Yosemite's ssh-agent. This is unrelated to the above problem, but it did occur to me at the same time (read here).
  3. using ssh-add still not fixes this for encrypted disks.
joni
  • 623
  • You should accept one of the good answers below. You should also avoid asking multiple questions in a single post. – Alain O'Dea Jan 24 '16 at 17:38
  • 1
    @AlainO'Dea First, yes I should, this is an old question and I forgot about it. For the second thing though: at the time of asking, it was not clear that the second issue (broken PKCS) would arise, see the edit history. – joni Jan 24 '16 at 18:00

6 Answers6

22
  1. The dialog for ssh-agent can be circumvented by adding the key in the console/terminal: ssh-add ~/.ssh/id_rsa. You can then paste the password into the terminal. Also, adding the -K option to ssh-add will save it to the keychain as per Oliver Lacans comment.
  2. As mattmcmanus said, id_rsa encryption using PKCS seems to be broken on OSX Mavericks ssh-agent. The fast workaround is to decrypt the keyfile, and encrypt it again with the standard ssh procedure (Key-derivation method: MD5...):
mv id_rsa id_rsa.pkcs
openssl rsa -in id_rsa.pkcs -out id_rsa
# enter passphrase to decrypt
chmod 0600 id_rsa
ssh-keygen -f id_rsa -p
# enter passphrase to encrypt again
joni
  • 623
  • 3
    While joni's answer is excellent I would recommend ssh-add -K ~/.ssh/id_rsa which "Store passphrases in your keychain" according to ssh-add --help. It will prevent you from having to re-run ssh-add every single time you open a new shell tab or when you restart your machine. – Olivier Lacan Dec 02 '15 at 08:14
2

Is it a PKCS#8 key and are you on mavericks? If so, that seems to be completely busted. Not sure there is a solution yet.

mattmcmanus
  • 141
  • 1
    why should this be? The problem so far is just that the password field on the dialog does not accept pasting. This already existed on 10.8, but because of the update to 10.9 I have to enter the passphrase again. – joni Oct 23 '13 at 17:31
  • OK, you seem to be right... look at my own answer. – joni Oct 23 '13 at 18:19
2

On Mac OS X El Capitan the ssh-add command can do this with a -K option:

$ ssh-add -K ~/.ssh/id_rsa
Enter passphrase for /Users/your.username/.ssh/id_rsa:

You can paste your password into this prompt with ⌘-V.

A session for this looks like this:

$ ssh-add -K ~/.ssh/id_rsa
Enter passphrase for /Users/your.username/.ssh/id_rsa:
Passphrase stored in keychain: /Users/your.username/.ssh/id_rsa
Identity added: /Users/your.username/.ssh/id_rsa (/Users/your.username/.ssh/id_rsa)

Relevant excerpt of SSH-ADD(1) brought up with man ssh-add:

-K When adding identities, each passphrase will also be stored in your keychain. When removing identities with -d, each passphrase will be removed from your keychain.

INFOSEC NOTE: Your password won't be shown in the shell, but will be exposed to all running applications via the clipboard. An autotype solution would be more secure.

Alain O'Dea
  • 121
1

You can run a script like this in AppleScript Editor:

tell application "System Events" to tell process "SecurityAgent"
    set value of text field 2 of scroll area 1 of group 1 of window 1 to "pa55word"
    click button 2 of group 2 of window 1
end tell
Lri
  • 105,117
  • 1
    thanks, this will help for the 'encrypted disks' dialogs. But why did apple disable this field for pasting??? – joni Oct 23 '13 at 18:18
  • Handy, but yeah, don't think this solves the PKCS#8 issue, where even if you enter the correct password, it says bad passphrase. – Bob Aman Jan 21 '15 at 12:35
  • Does not make sense. Now your top-highly-secret password is open to everyone. That is why the TS uses a password manager to have her passwords centralized and highly protected. – wh81752 Nov 06 '15 at 12:08
  • 1
    Doesn't work on El Capitan. First it asks for Script Editor to get Assistive Control System Events got an error: Script Editor is not allowed assistive access. Once that is allowed under System Preferences | Security & Privacy I get System Events got an error: Can’t get window 1 of process "SecurityAgent". Invalid index. – Alain O'Dea Jan 24 '16 at 16:22
1

I had the same problem. After finding this question, I kept looking and found an answer elsewhere. This is an older question, but it has no accepted answers and is still high on search lists. (not sure of the stackexchange etiquette on that).

RE not being able to copy/paste: It's apparently by design. The intention is to prevent all access to the field from the clipboard to prevent a malicious program from scraping password boxes. I'd think pasting (and not cutting) should be allowed, but maybe there's some technical reason.

For the ssh-agent stuff, as of (at least) Yosemite, the -K option in ssh-add -K ~/.ssh/blah does what you'd like -- type the password once, it's stored in your keychain, and ssh-agent will transparently unlock for you. To try and be safer, I put my ssh passphrases in a separate keychain that locks itself periodically.

PerilousApricot
  • 305
0

Using brew openssl and openssh fixes the issue.

brew update
brew install openssl
brew link openssl --force
brew install openssh

# confirm correct bins are being used
# both should be located in /usr/local/bin
which openssl
which openssh

# add key back to keychain
ssh-add ~/.ssh/id_rsa

I'm not sure if force linking openssl breaks anything on Mavricks. So far, I haven't noticed any issues.

simple10
  • 31
  • 1
    There is no (longer a) brew formula for openssh. – Adam Liter Jul 25 '14 at 16:55
  • There is still brew tap homebrew/dupes however. That said, these steps didn't seem to resolve this issue for me. – Bob Aman Jan 21 '15 at 12:34
  • @simple10 This answer provides little to no value. You should at least provide the version of openssl / openssh that fixes the problem. Additionally please elaborate why it would do so. – wh81752 Nov 06 '15 at 12:10