Getting started with 1Password for your growing team, or refining your setup? Our Secured Success quickstart guide is for you.
Forum Discussion
SSH Agent Forwarding
I'm really enjoying using 1Password as a ssh-agent with biometric unlock. I'm wondering if it's possible forward the SSH agent though.
Scenario:
I have two macs with 1Password setup with biometric unlock for ssh keys (work machine and personal).
Occasionally, I want to login from my pesonal. machine and git push on my work machine. If I attempt to do this now, I get errors like this:
sign_and_send_pubkey: signing failed for ED25519 "/Users/MyName/.ssh/id_ed25519" from agent: agent refused operation
sign_and_send_pubkey: signing failed for RSA "SSH Key" from agent: agent refused operation
git@github.com: Permission denied (publickey).
I think what's happening is that ssh on my work machine is trying to use the 1password agent with biometric unlock, but the machine is locked (display asleep) so the biometric prompt is immediately dismissed and the auth fails.
I'm wondering if I can forward the SSH agent from my personal machine to the work machine. I would expect ssh -A work to handle this, but it seems to get the same error as above.
Any ideas on how to do this, or do I have to forgo biometric unlock if I want to ssh from the machines remotely.
1Password Version: 8.7.0
Extension Version: Not Provided
OS Version: macOS 12.3
22 Replies
floris_1P1Password Team
Yes, definitely!
Will a description of this also be back-ported to the docs so the unaware might discover it more easily? :)
- floris_1P
Starting with version
8.10.4. - floris_1P
We're considering to have
op-ssh-signcheck forSSH_TTY/SSH_CONNECTIONandSSH_AUTH_SOCK, and if both are set, useSSH_AUTH_SOCKinstead. That should remove the need for these SSH config and rc file snippets.Just wanted to follow up here that this has now been implemented!
Here's a simple redirect script that I use as my
gpg.ssh.programsetting in gitconfig. It's based on floris_1P's comment above and can be used as a placeholder untilop-ssh-signsupports this natively:git-ssh-sign
```!/bin/bash
if [[ "$SSH_CONNECTION" ]] && [[ "$SSH_AUTH_SOCK" ]]; then
ssh-keygen "$@"
else
/Applications/1Password.app/Contents/MacOS/op-ssh-sign "$@"
fi
```In gitconfig:
[gpg "ssh"]
program = /path/to/git-ssh-sign
Jack_P_1PHi @datwaft:
Great question. While it's possible that the path to the agent may change in the future, there aren't any plans or intent to change it.
Additionally, that path will be the same on every macOS install, and won't vary based on the specific Mac computer it's installed on.
Jack
I saw that in the documentation and tried to do something like that but it didn't work for me.
I just tried once again and it seems to work, I probably had the wrong socket set toSSH_AUTH_SOCK.Quick question, is
~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sockalways the path to the 1Password agent socket or it can change in the future? I want to see if I should hardcode it in my dotfiles with a condition liketest -z $SSH_TTY.- Jack_P_1P
Hi @datwaft:
If you're looking to use 1Password SSH agent commit signing on a device when accessed locally as well as remotely, your best bet is to ensure that
$SSH_AUTH_SOCKis set to your forwarded agent socket when SSH'd into that device, and then the 1Password SSH agent socket when you're using it in person.SSH signing by default uses the agent pointed to by
$SSH_AUTH_SOCK. and settingop-ssh-signas the SSH program overrides that function.Jack
