2

I had a not protected by passphrase ssh key which I use to connect with a server. Now I want to add a passphrase to the key, so I've done:

ssh-keygen -p

and added a new passphrase:

Enter file in which the key is (/home/user/.ssh/id_rsa): 
Enter old passphrase: 
Key has comment '/home/user/.ssh/id_rsa'
Enter new passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved with the new passphrase.

Then, I try to connect again to the server:

ssh [email protected] -v

but I'm still logged without entering the passphrase:

debug1: Authentications that can continue: publickey

debug1: Next authentication method: publickey

debug1: Offering RSA public key: /home/user/.ssh/id_rsa

debug1: Server accepts key: pkalg ssh-rsa blen 279

debug1: Authentication succeeded (publickey).

Authenticated to server.com ([xxx.xx.xxx.xx]:22).

Why I'm not asked for the passphrase?

Edit:

Seahorse was storing the keys for me, so this was the issue.

4
  • Do you use an SSH agent?
    – Sven
    Commented May 11, 2016 at 8:23
  • @Sven - Yes, but the passphrase is a new one, so the agent shouldn't be able to use it yet. How could I temporally disable the agent to check if it's the case?
    – Manolo
    Commented May 11, 2016 at 8:27
  • ssh-add -D or see man ssh-add. ssh-add -l will list the keys it currently keeps.
    – Sven
    Commented May 11, 2016 at 8:30
  • @Sven - I forgot that I was using wiki.gnome.org/Apps/Seahorse to store my keys, so it was storing the key for me.
    – Manolo
    Commented May 11, 2016 at 9:51

1 Answer 1

5

ssh-agent is storing encrypted key in memory so change to the physical key on disk does not affect its functionality.

If you want make sure the change is effective, remove the key from agent and add it once more as noted in comments (ssh-add -D to remove and ssh-add to add the key again from default location).

2
  • I've edited my question because I've found out the issue. Thank you anyway.
    – Manolo
    Commented May 11, 2016 at 9:54
  • @Manolo: This is the correct answer then, since SeaHorse is a form of SSH agent. You should either accept this answer or write your own explaining this in detail. Just editing your question is not enough.
    – Sven
    Commented May 11, 2016 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .