git 如何删除 ssh 密钥？

How to remove an ssh key?

提问by user1364743

I currently have an old SSH key uploaded on a server. The problem is I lost my ~/.sshdirectory (with the original id_rsaand id_rsa.pubfiles).

我目前在服务器上上传了一个旧的 SSH 密钥。问题是我丢失了~/.ssh目录（包含原始目录id_rsa和id_rsa.pub文件）。

Consequently, I want to remove the old SSH key directly on the server and upload a new one.

因此，我想直接在服务器上删除旧的 SSH 密钥并上传一个新密钥。

I tried the following command without success:

我尝试了以下命令但没有成功：

$> ssh-add -D

Is there a way to completely remove an SSH key?

有没有办法完全删除 SSH 密钥？

采纳答案by VonC

Note that there is at least two bug report for ssh-add -d/-Dnotremoving keys:

请注意，至少有两个关于ssh-add -d/-D不删除密钥的错误报告：

• "Debian Bug report #472477: ssh-add -Ddoes not remove SSH key from gnome-keyring-daemonmemory"
• "Ubuntu: ssh-add -Ddeleting all identities does not work. Also, why are all identities auto-added?"

• “ Debian 错误报告 #472477：ssh-add -D不会从gnome-keyring-daemon内存中删除 SSH 密钥”
• “ Ubuntu：ssh-add -D删除所有身份不起作用。另外，为什么会自动添加所有身份？“

The exact issue is:

确切的问题是：

ssh-add -d/-Ddeletes only manually addedkeys from gnome-keyring.
There is no way to delete automatically added keys.
This is the original bug, and it's still definitely present.

So, for example, if you have two different automatically-loaded ssh identities associated with two different GitHub accounts -- say for work and for home -- there's no wayto switch between them. GitHubtakes the first one which matches, so you always appear as your 'home' user to GitHub, with no way to upload things to work projects.

Allowing ssh-add -dto apply to automatically-loadedkeys (and ssh-add -t Xto change the lifetime of automatically-loaded keys), would restore the behavior most users expect.

ssh-add -d/-D仅从gnome-keyring 中删除手动添加的密钥。
无法删除自动添加的密钥。
这是原始错误，它仍然肯定存在。

因此，例如，如果您有两个不同的自动加载的 ssh 身份与两个不同的 GitHub 帐户相关联——比如工作和家庭——则无法在它们之间切换。GitHub 采用第一个匹配的，因此您始终作为 GitHub 的“家庭”用户出现，无法将内容上传到工作项目。

允许ssh-add -d应用于自动加载的密钥（并ssh-add -t X更改自动加载的密钥的生命周期），将恢复大多数用户期望的行为。

---

---

More precisely, about the issue:

更准确地说，关于这个问题：

The culprit is gpg-keyring-daemon:

• It subverts the normal operation of ssh-agent, mostly just so that it can pop up a pretty box into which you can type the passphrase for an encrypted ssh key.
• And it paws through your .sshdirectory, and automatically adds any keys it finds to your agent.
• And it won't let you delete those keys.

How do we hate this? Let's not count the ways -- life's too short.

The failure is compounded because newer ssh clients automatically try all the keys in your ssh-agent when connecting to a host.
If there are too many, the server will reject the connection.
And since gnome-keyring-daemon has decided for itself how many keys you want your ssh-agent to have, and has autoloaded them, AND WON'T LET YOU DELETE THEM, you're toast.

罪魁祸首是gpg-keyring-daemon：

• 它颠覆了 ssh-agent 的正常操作，主要是为了它可以弹出一个漂亮的框，您可以在其中键入加密 ssh 密钥的密码。
• 它会遍历您的.ssh目录，并自动将它找到的任何密钥添加到您的代理中。
• 它不会让你删除这些键。

我们怎么讨厌这个？让我们不计算方式 - 生命太短暂了。

失败是复杂的，因为较新的 ssh 客户端在连接到主机时会自动尝试 ssh-agent 中的所有密钥。
如果太多，服务器将拒绝连接。
并且由于 gnome-keyring-daemon 自己决定了您希望 ssh-agent 拥有多少个密钥，并且已经自动加载了它们，并且不会让您删除它们，所以您很高兴。

This bug is still confirmed in Ubuntu 14.04.4, as recently as two days ago (August 21st, 2014)

就在两天前（2014 年 8 月 21 日），此错误仍在 Ubuntu 14.04.4 中得到确认

---

---

A possible workaround:

一个可能的解决方法：

• Do ssh-add -Dto delete all your manuallyadded keys. This also locks the automatically added keys, but is not much use since gnome-keyringwill ask you to unlock them anyways when you try doing a git push.
• Navigate to your ~/.sshfolder and move all your key files except the one you want to identify with into a separate folder called backup. If necessary you can also open seahorse and delete the keys from there.
• Now you should be able to do git pushwithout a problem.

• 不要ssh-add -D删除所有手动添加的钥匙。这也会锁定自动添加的密钥，但没有多大用处，因为gnome-keyring当您尝试执行git push.
• 导航到您的~/.ssh文件夹并将所有密钥文件（除了要标识的文件）移动到名为备份的单独文件夹中。如有必要，您还可以打开 seahorse 并从那里删除密钥。
• 现在您应该可以git push毫无问题地进行操作了。

---

---

Another workaround:

另一种解决方法：

What you really want to do is to turn off gpg-keyring-daemonaltogether.
Go to System --> Preferences --> Startup Applications, and unselect the "SSH Key Agent (Gnome Keyring SSH Agent)" box -- you'll need to scroll down to find it.

You'll still get an ssh-agent, only now it will behave sanely: no keys autoloaded, you run ssh-add to add them, and if you want to delete keys, you can. Imagine that.

您真正想要做的是gpg-keyring-daemon完全关闭。
转到System --> Preferences --> Startup Applications并取消选择“ SSH Key Agent (Gnome Keyring SSH Agent)”框 - 您需要向下滚动才能找到它。

你仍然会得到一个ssh-agent，只是现在它会正常运行：没有自动加载密钥，你运行 ssh-add 来添加它们，如果你想删除密钥，你可以。设想。

This commentsactually suggests:

这个评论实际上表明：

The solution is to keep gnome-keyring-managerfrom ever starting up, which was strangely difficult by finally achieved by removing the program file's execute permission.

解决办法是gnome-keyring-manager永远不启动，最后通过删除程序文件的执行权限来实现这一点奇怪地困难。

---

---

Ryan Lueadds another interesting corner case in the comments:

Ryan Lue在评论中添加了另一个有趣的角落案例：

In case this helps anyone: I even tried deleting the id_rsaand id_rsa.pubfiles altogether, and the key was still showing up.

Turns out gpg-agentwas caching them in a ~/.gnupg/sshcontrolfile; I had to manually delete them from there.

如果这对任何人有帮助：我什至尝试完全删除id_rsa和id_rsa.pub文件，但密钥仍然出现。

原来gpg-agent是将它们缓存在一个~/.gnupg/sshcontrol文件中；我不得不从那里手动删除它们。

That is the case when the keygriphas been added as in here.

这时候的情况了keygrip已经被添加在这里。

回答by Tim

Unless I'm misunderstanding, you lost your .sshdirectory containing your private key on your local machine and so you want to remove the public key which was on a server and which allowed key-based login. In that case, it will be stored in the .ssh/authorized_keysfile in your home directory on the server. You can just edit this file with a text editor and delete the relevant line if you can identify it (even easier if it's the only entry!). I hope that key wasn't your only method of access to the server and you have some other way of logging in and editing the file. You can either manually add a new public key to authorised_keysfile or use ssh-copy-id. Either way, you'll need password auth set up for your account on the server, or some other identity or access method to get to the authorized_keysfile on the server.

除非我误解了，否则.ssh您在本地计算机上丢失了包含私钥的目录，因此您想删除服务器上允许基于密钥登录的公钥。在这种情况下，它将存储在.ssh/authorized_keys服务器主目录中的文件中。您可以使用文本编辑器编辑此文件，并在可以识别的情况下删除相关行（如果它是唯一的条目，则更容易！）。我希望该密钥不是您访问服务器的唯一方法，您还有其他登录和编辑文件的方法。您可以手动添加新的公钥到authorised_keys文件或使用ssh-copy-id. 无论哪种方式，您都需要在服务器上为您的帐户设置密码身份验证，或者使用其他身份或访问方法来访问authorized_keys服务器上的文件。

ssh-addadds identities to your ssh agent which handles management of your identities locally and "the connection to the agent is forwarded over SSH remote logins, and the user can thus use the privileges given by the identities anywhere in the network in a secure way." (man page), so I don't think it's what you want in this case. It has no way to get your public key onto a server without you having access to said server via an ssh login as far as I know.

ssh-add向您的 ssh 代理添加身份，该代理在本地处理您的身份管理，并且“与代理的连接通过 SSH 远程登录转发，因此用户可以以安全的方式使用网络中任何地方的身份赋予的特权。” （手册页），所以我认为在这种情况下这不是您想要的。据我所知，如果您无法通过 ssh 登录访问所述服务器，则无法将您的公钥放到服务器上。

回答by Derek Soike

If you're trying to perform an ssh-related operation and get the following error:

如果您尝试执行与 ssh 相关的操作并收到以下错误：

$ git fetch
no such identity: <ssh key path>: No such file or directory

You can remove the missing ssh key from your ssh agent with the following:

您可以使用以下命令从 ssh 代理中删除丢失的 ssh 密钥：

$ eval `ssh-agent -s`  # start ssh agent
$ ssh-add -D <ssh key path>  # delete ssh key

回答by Anton Balashov

I opened "Passwords and Keys" application in my Unity and removed unwanted keys from Secure Keys-> OpenSSH keysAnd they automatically had been removed from ssh-agent -las well.

我在 Unity 中打开了“密码和密钥”应用程序，并从Secure Keys-> OpenSSH 密钥中删除了不需要的密钥， 并且它们也自动从ssh-agent -l 中删除了。

回答by Nagev

I can confirm that this bug is still present in Ubuntu 19.04. The workaround suggested by @VonC worked perfectly, summarizing for my version:

我可以确认这个错误仍然存​​在于 Ubuntu 19.04 中。@VonC 建议的解决方法工作得很好，总结了我的版本：

• Click on Activities tab on top left corner
• On the search box that comes up, begin typing "startup applications"
• Click on the "Startup Applications" icon
• On the box that pops up, select the gnome key ring manager application (can't remember the exact name on the GUI but it is distinctive enough) and remove it.

• 单击左上角的活动选项卡
• 在出现的搜索框中，开始输入“启动应用程序”
• 单击“启动应用程序”图标
• 在弹出的框中，选择 gnome 密钥环管理器应用程序（无法记住 GUI 上的确切名称，但它足够独特）并将其删除。

What I did next was to try ssh-add -Dagain, and after reboot ssh-add -ltold me The agent has no identities.I confirmed that I still had the ssh-agentdaemon running with ps aux | grep agent. So I added the key I most frequently use with GitHub (ssh-add ~/.ssh/id_ecdsa) and all is good!

我接下来做的是再试ssh-add -D一次，重启后ssh-add -l告诉我代理没有身份。我确认我仍然ssh-agent使用ps aux | grep agent. 所以我添加了我最常在 GitHub ( ssh-add ~/.ssh/id_ecdsa) 中使用的密钥，一切都很好！

Now I can do the normal operations with my most frequently used repository, and if I occasionally require access to the other repository which uses the RSA key, I just dedicate one terminal for it with export GIT_SSH_COMMAND="ssh -i /home/me/.ssh/id_rsa.pub". Solved! Credit goes to @VonC for pointing out the bug and the solution.

现在我可以对我最常用的存储库进行正常操作，如果我偶尔需要访问使用 RSA 密钥的另一个存储库，我只需使用export GIT_SSH_COMMAND="ssh -i /home/me/.ssh/id_rsa.pub". 解决了！感谢@VonC 指出错误和解决方案。

回答by Niraj Paul

Check .ssh key or not in your system

检查 .ssh 密钥是否在您的系统中

1. Go to folder --> /Users/administrator/.ssh/id_ed25519.pub

1. 转到文件夹 --> /Users/administrator/.ssh/id_ed25519.pub

If Not than

如果不是

1. Open Terminal.

2. 打开终端。

Past in the terminal

过去在终端

1. Check user --> ssh -T [email protected]

3. 检查用户 --> ssh -T [email protected]

Remove Existing .ssh Key

删除现有的 .ssh 密钥

1. Remove Existing .ssh Key --> rm ~/.ssh/github_rsa.pub

4. 删除现有的 .ssh 密钥 --> rm ~/.ssh/github_rsa.pub

Create New

创建新的

1. Create New .ssh Key --> ssh-keygen -t rsa -b 4096 -C "[email protected]"

2. Public key has been saved in"/Users/administrator/.ssh/id_ed25519.pub."

3. Open Public key saved path.
4. Copy the .ssh Key--> GitLab Account --> Setting --> SSH Key -->Add key
5. Test again from terminal--> ssh -T [email protected]

5. 创建新的 .ssh 密钥 --> ssh-keygen -t rsa -b 4096 -C "[email protected]"

6. 公钥已保存在“/Users/administrator/.ssh/id_ed25519.pub”中。

7. 打开公钥保存路径。
8. 复制 .ssh 密钥--> GitLab 帐户 --> 设置 --> SSH 密钥 --> 添加密钥
9. 从终端再次测试--> ssh -T [email protected]

回答by Doug0

The solution for me (OpenSuse Leap 42.3, KDE) was to rename the folder ~/.gnupgwhich apparently contained the cached keys and profiles. After KDE logout/logon the ssh-add/agent is running again and the folder is created from scratch, but the old keys are all gone.

我的解决方案（OpenSuse Leap 42.3，KDE）是重命名~/.gnupg显然包含缓存密钥和配置文件的文件夹。在 KDE 注销/登录后，ssh-add/agent 再次运行并且文件夹是从头开始创建的，但是旧的密钥都没有了。

I didn't have success with the other approaches.

其他方法我没有成功。