2

I had a not protected by passphrase ssh key which I use to connect with a server. Now I want to add a passphrase to the key, so I've done:

ssh-keygen -p

and added a new passphrase:

Enter file in which the key is (/home/user/.ssh/id_rsa): 
Enter old passphrase: 
Key has comment '/home/user/.ssh/id_rsa'
Enter new passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved with the new passphrase.

Then, I try to connect again to the server:

ssh user@server.com -v

but I'm still logged without entering the passphrase:

debug1: Authentications that can continue: publickey

debug1: Next authentication method: publickey

debug1: Offering RSA public key: /home/user/.ssh/id_rsa

debug1: Server accepts key: pkalg ssh-rsa blen 279

debug1: Authentication succeeded (publickey).

Authenticated to server.com ([xxx.xx.xxx.xx]:22).

Why I'm not asked for the passphrase?

Edit:

Seahorse was storing the keys for me, so this was the issue.

Community
  • 1
Manolo
  • 552
  • 2
  • 8
  • 23
  • Do you use an SSH agent? – Sven May 11 '16 at 08:23
  • @Sven - Yes, but the passphrase is a new one, so the agent shouldn't be able to use it yet. How could I temporally disable the agent to check if it's the case? – Manolo May 11 '16 at 08:27
  • `ssh-add -D` or see `man ssh-add`. `ssh-add -l` will list the keys it currently keeps. – Sven May 11 '16 at 08:30
  • @Sven - I forgot that I was using https://wiki.gnome.org/Apps/Seahorse to store my keys, so it was storing the key for me. – Manolo May 11 '16 at 09:51

1 Answers1

5

ssh-agent is storing encrypted key in memory so change to the physical key on disk does not affect its functionality.

If you want make sure the change is effective, remove the key from agent and add it once more as noted in comments (ssh-add -D to remove and ssh-add to add the key again from default location).

Jakuje
  • 9,715
  • 2
  • 42
  • 45
  • I've edited my question because I've found out the issue. Thank you anyway. – Manolo May 11 '16 at 09:54
  • @Manolo: This is the correct answer then, since SeaHorse is a form of SSH agent. You should either accept this answer or write your own explaining this in detail. Just editing your question is not enough. – Sven May 11 '16 at 10:19