Not sure why you're getting downvotes. I use key authentication for all my SSH needs.

If it's important enough to still need a password on top of that, the password can go on the key.

Huh? Always encrypt the ssh-key, and use ssh-agent for convenience. That said it is now quite easy to set up proper two-factor authentication: eg key and otp.

On OS X, the keychain app caches the private key password forever. Even after a reboot. Any idea how to fix this? Ideally Keychain should ask me again (say) an hour after my last login with the same key.

I don't think you can set this at a key-specific level, but in Keychain Access, you can ctrl-click on the keychain and set it to lock after x min of inactivity / when sleeping.

I'm not sure if you can put your ssh keys on a specific (non-login) keychain.

If you want those, you may want to go to Keychain Access > Preferences > First Aid > uncheck "Keep login keychain unlocked".

You can drag-and-drop items between keychains -- you just need to enter the passwords for both keychains when doing so.

This makes it possible to keep valuable items in one or more auxiliary keychains set to always prompt (lock after 0 minutes). (This technique isn't a panacea but it contributes to defense in depth.)

Brilliant, I didn't know you could lock them.

However, it doesn't solve the agent caching problem. Once a key has been added the agent, Keychain never asks again, even after it's locked.

ssh-add has an option "-t <seconds>" to make added keys automatically expire. That will work, but it only works for newly added keys. As far as I can tell, the Keychain helper calls ssh-add to add keys, and I don't see a way to have it pass -t.

Edit: Looks like holmar's suggestion below to change the ssh-agent daemon to run with -t would fix this.

I'm using this here: http://apple.stackexchange.com/questions/118223/make-my-pass...

At work we have to send data to a few third parties, it's pretty much up to them how they set up their end. I think everything is using SFTP at least, but a few still have passwords rather than keys. The accounts are restricted so you can't get a full shell though. My guess is these systems are designed by non-technical people who don't really understand the issues.

well, for generating/uploading your key, you need a password.

When I was first introduced to SSH, the administrator had me transmit my public key to them and they added it to my account themselves, and that's how I've done it on all the servers I administrate since. This way, you can disable password authentication entirely.

It's just a honeypot, not a real server with password-based auth.

Who is proposing using passwords for SSH is a good idea? This is a honeypot.