Re:Protecting SSH Keys with macOS Secure Enclave
by briHass on Wednesday November 11, 2026 @12:09PM
(#50455782)
Not sure how it works on macos, but on Windows the downside of agents using TPM backed Windows Hello keys (sk) is that the session can't be reused for scp/sftp and agents like to do one-action scripts, so you're doing the user presence pin/finger multiple times for each ssh command it executes.
I've started building a timeout-based ssh-agent population utility, but if I'm honest, TPM keys without user presence is probably sufficient.
Re:Protecting SSH Keys with macOS Secure Enclave
by jon-wood on Thursday November 12, 2026 @05:50AM
(#50465473)
Set the following in your SSH config, which will cause SSH to establish a single control channel when it first opens a connection to a host and maintain it until there's been 10 minutes of inactivity. That way the first connection requires auth for your SSH agent but it can then be reused for things like SFTP channels or opening another terminal.
Host \*
controlMaster auto
controlPath ~/.ssh/master-%r@%n:%p
controlPersist 10m
1. The Secure Enclave being inaccessible when you're not present is a feature, not a bug. If you need to run headless then its not the correct solution to your problem and you'll have to find another.
2. You don't need an SSH agent proxy, you can use a `match` block in your `ssh_config` with something like `host * exec "test -z $SSH_TTY` to check whether you're operating over an SSH connection and select Secretive's SSH agent if you're using the machine locally.