Home

Mac ssh-keygen command not found

Mac ssh-keygen command not found

How to Update OpenSSH on Mac OS X. Just for kicks, I wanted to try using an ECDSA key for ssh authentication. Unfortunately, the OpenSSH bundled with Mountain Lion (10.8) does not support ECDSA keys (nor can one even be generated with ssh-keygen.) The man pages for ssh-keygen and ssh-agent say they support ECDSA, but this is due to a naive man page generation assuming that since the OpenSSL library supports it, OpenSSH will too. Also, a PCI compliant OpenSSH isn t bundled with OS X Lion (10.7) or older so this will also be useful for those users as well. Thankfully, Homebrew already has a recipe for installing an up-to-date OpenSSH so most of the work of upgrading is already done. If you don t already have Homebrew installed, follow its installation instructions first. 1. First we ll need to add the system duplicates repository to Homebrew. $ brew tap homebrew/dupes. 2. Compile and install OpenSSH. I want to use a newer OpenSSL and all its optimizations, which Homebrew will happily provide via an option. Also, to make ssh-agent launchd and keychain compatible, there s a nice undocumented option to apply the necessary patch before compiling too. $ brew install openssh --with-brewed-openssl --with-keychain-support. 3. Like the caveat notes when brew finishes, you need to update the launchd plist for ssh-agent to use the new Homebrew binary. By replacing /usr/bin/ssh-agent with /usr/local/bin/ssh-agent. $ launchctl stop $ launchctl unload -w $ sudo vi $ launchctl load -w -S Aqua. 4. The SSH_AUTH_SOCK env var needs to be updated for any open or new terminal sessions. It s best to logout/login or restart because we cannot modify the variables in the user session scope that all new processes inherit from. However, if that s not an option, can do this instead. $ export SSH_AUTH_SOCK=$(launchctl getenv SSH_AUTH_SOCK. 5. Generate an ECDSA key. $ ssh-keygen -t ecdsa -b 521. Once the pub key from your new ECDSA key pair is added to on your server(s), should be good to go (assuming OpenSSH on your server also supports ECDSA keys. Here are openssl speed runs showing considerable improvements in the newer OpenSSL on a Late-2012 rMBP with a 2.9 Ghz i7 (Ivy Bridge.