One alternative to satisfy your implied desire to not have decrypted keys available all the time is to turn off both UseKeychain and AddKeysToAgent, as in: Host * If you have UseKeychain yes in your config, ssh-agent will happily re-decrypt the key again next time it is needed (see above answer to question 1). It would only clear the memory of the running ssh-agent of all decrypted private keys. While you could put ssh-add -D into a cron job, and it probably would do some of what you want, it would not remove the passphrases from the keychain.

What is the best option if I want to regularly clear any private key passphrases? I could use ssh-add -D under a cron job.

To see it, you need to select 'View > Show Invisible Items' and then ssh key passphrase entries will be visible.Ĭhances are the 'unnamed private key' you were seeing was some other RSA (or DSA) key. Starting with macOS Sierra (10.12), Apple moved which keychain ssh keys were stored. If you open Keychain Access on your Mac, and search for ssh, you likely won't see your ssh key passphrase.

How can I identify and clear the passphrase for my default private key in Keychain Access? I see an unnamed private key, but I don't want to delete it without knowing for sure that it is my stored SSH key.

However, a partially satisfying solution for nearly the same effect can be had - see answer to question 3 below. There is (to my knowledge) no way to have macOS store the passphrases temporarily.

If you need the convenience of temporarily storing passphrases, what is the standard?

Also useful to see another related question. If you also use the the AddKeysToAgent yes directive, then that decrypted key will be stored in the agent for future use. If you use the UseKeychain yes directive in your ~/.ssh/config, then any program connecting to the ssh-agent socket will allow ssh-agent to reach into the Keychain for the passphrase to decrypt your private key.

It seems like there are two options: ssh-agent or Keychain Access.

The distinction is important to answer your questions.

ssh-agent (on macOS or any system) holds the decrypted private key in memory.

macOS will allow you to store the private key passphrases in the macOS keychain.

Before we start, let's clarify a couple of points:

Decrypt Keychain.Plist