Posted By: Anonymous
I currently have an old SSH key uploaded on a server. The problem is I lost my
~/.ssh directory (with the original
Consequently, I want to remove the old SSH key directly on the server and upload a new one.
I tried the following command without success:
$> ssh-add -D
Is there a way to completely remove an SSH key?
Note that there are at least two bug reports for
ssh-add -d/-D not removing keys:
- "Debian Bug report #472477:
ssh-add -Ddoes not remove SSH key from
ssh-add -Ddeleting all identities does not work. Also, why are all identities auto-added?"
The exact issue is:
ssh-add -d/-Ddeletes only manually added keys from gnome-keyring.
There is no way to delete automatically added keys.
This is the original bug, and it’s still definitely present.
So, for example, if you have two different automatically-loaded ssh identities associated with two different GitHub accounts — say for work and for home — there’s no way to switch between them. GitHubtakes the first one which matches, so you always appear as your ‘home’ user to GitHub, with no way to upload things to work projects.
ssh-add -dto apply to automatically-loaded keys (and
ssh-add -t Xto change the lifetime of automatically-loaded keys), would restore the behavior most users expect.
More precisely, about the issue:
The culprit is
- It subverts the normal operation of ssh-agent, mostly just so that it can pop up a pretty box into which you can type the passphrase for an encrypted ssh key.
- And it paws through your
.sshdirectory, and automatically adds any keys it finds to your agent.
- And it won’t let you delete those keys.
How do we hate this? Let’s not count the ways — life’s too short.
The failure is compounded because newer ssh clients automatically try all the keys in your ssh-agent when connecting to a host.
If there are too many, the server will reject the connection.
And since gnome-keyring-daemon has decided for itself how many keys you want your ssh-agent to have, and has autoloaded them, AND WON’T LET YOU DELETE THEM, you’re toast.
This bug is still confirmed in Ubuntu 14.04.4, as recently as two days ago (August 21st, 2014)
A possible workaround:
ssh-add -Dto delete all your manually added keys. This also locks
the automatically added keys, but is not much use since
gnome-keyringwill ask you to unlock them anyways when you try doing a
- Navigate to your
~/.sshfolder and move all your key files except the one you want to identify with into a separate folder called backup. If necessary you can also open seahorse and delete the keys from there.
- Now you should be able to do
git pushwithout a problem.
What you really want to do is to turn off
System --> Preferences --> Startup Applications, and unselect the "
SSH Key Agent (Gnome Keyring SSH Agent)" box — you’ll need to scroll down to find it.
You’ll still get an
ssh-agent, only now it will behave sanely: no keys autoloaded, you run ssh-add to add them, and if you want to delete keys, you can. Imagine that.
This comments actually suggests:
The solution is to keep
gnome-keyring-managerfrom ever starting up, which was strangely difficult by finally achieved by removing the program file’s execute permission.
In case this helps anyone: I even tried deleting the
id_rsa.pubfiles altogether, and the key was still showing up.
gpg-agentwas caching them in a
~/.gnupg/sshcontrolfile; I had to manually delete them from there.