I have problem connecting via ssh using Tramp in Emacs on MS-Windows whenever the private ssh key I use is configured with a passphrase.

Here's the problem :

I. What works :

  1. On the command line ssh -i path/to/shh_key_WITH_NO_passphrase login@hostname, works just fine and I'm connected to remote server.
  2. On the command line ssh -i path/to/shh_key_WITH_passphrase login@hostname, I've got a prompt asking for my passphrase for this key :

enter image description here

And then I'm connected to the remote server.

  1. In Emacs : C-x C-f RET /sshx: RET ssh_key_WITH_NO_passphrase, the connection succeed and I'm able to go through files and open them :

enter image description here

II. What don't works :

  1. In Emacs : C-x C-f RET /sshx: RET ssh_key_WITH_passphrase

What happens with previous point 1. :

I get a Opening connection nil for ssh_key_WITH_passphrase using ssh... and it just hang there and I have to hit C-g like continously to get it out of there :

enter image description here

III. How to reproduce the bug :

  1. Get GNU Emacs 28.2 running on MS-Windows 10
  2. Create two ssh key to connect to a remote server, one with a passphrase and one without, see gitlab's help page for that.
  3. Set tramp-default-method to "ssh" or "sshx" (either don't work on my side) with for example M-: RET (setq tramp-default-method "sshx")
  4. Try to connect with one of the 2 keys, the one with a passphrase should not work, for that I've configure a config file in the .ssh/ in which I describe how OpenSSH should connect with remote server :
Host Co_No_Phrase
     HostName hostname
     Port 22
     User login
          IdentityFile HOME/.ssh/id_rsa
          IdentitiesOnly yes

Host Co_Phrase
     HostName hostname
     Port 22
     User login
          IdentityFile HOME/.ssh/id_rsa_phrase
          IdentitiesOnly yes

Then :

_ C-x C-f RET /sshx: RET Co_No_Phrase should tell Emacs to use Tramp to connect to hostname with the key that has no passphrase.

_ C-x C-f RET /sshx: RET Co_Phrase should tell Emacs to use Tramp to connect to hostname with the key that has a passphrase.

I love using Emacs for coding remotly on clusters, and never had any problem when I was on Linux, but for professionnal reasons I have to be on Windows now, poor me... It's awful, pls help me ?

Thanks a lot to the community

  • I doubt that your example works. At least a colon is missing, and you should do C-x C- RET /sshx:: . Furthermore, it is hard to debug with this informatiion. I don't understand what you mean with ssh_key_WITH_NO_passphrase - I'm not aware of Emacs/Tramp asking for an ssh key. Mar 21, 2023 at 11:54
  • @MichaelAlbinus I've edit things for more clarity, sorry always difficult to be clear spot on publication. I've added a "Reproduce the bug" section if it can help debugging Mar 22, 2023 at 8:07
  • Can't do better than that in terms of writing a post for me.. Mar 22, 2023 at 16:56

1 Answer 1


Thanks for the precise recipe. I could reproduce it on my Windows 10 VM, running Emacs 30.0.50 and OpenSSH_for_Windows_8.1p1. After instrumenting the ssh call in Tramp with -v, there is

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Offering public key: C:\\Users\\albinus/tmp/key_with_passphrase RSA SHA256:hqITNMbzDAJmafsNVNJLBffCiqGJ0Eoux3y+H8TfZZw explicit
debug1: Server accepts key: C:\\Users\\albinus/tmp/key_with_passphrase RSA SHA256:hqITNMbzDAJmafsNVNJLBffCiqGJ0Eoux3y+H8TfZZw explicit
debug1: read_passphrase: can't open /dev/tty: No such file or directory

So Tramp (Emacs) cannot read the passphrase. As solution, I've started ssh-agent as described in Key-based authentication in OpenSSH for Windows. Note, that you must run powershell as administrator. And then, apply

PS C:\Windows\system32> Get-Service ssh-agent | Set-Service -StartupType Manual
PS C:\Windows\system32> Start-Service ssh-agent
PS C:\Windows\system32> ssh-add C:\Users\albinus\tmp\key_with_passphrase
Enter passphrase for C:\Users\albinus\tmp\key_with_passphrase:
Identity added: C:\Users\albinus\tmp\key_with_passphrase (albinus@win10)

And indeed, the remote connection /sshx:co_phrase: opens then as expected.

  • Thks for the answer, looks like it's the right direction. But I've still got a problem : ssh-add /path/to/key_with_passphrase returns Permissions for '~\\.ssh\\id_rsa' are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored. So I've tried to change users permissions to different ones but no success : PS > icacls.exe .\id_rsa .\id_rsa AUTORITE NT\Système:(N) INTRA\TC273997:(N) IS243769\adminus:(F) BUILTIN\Administrateurs:(F) Mar 25, 2023 at 8:46
  • During my tests, I've got the same problem. superuser.com/questions/1296024/… has helped me. Mar 25, 2023 at 8:57
  • Worked like a charm, thks a lot Mar 25, 2023 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.