Signing back into the Community for the first time? You'll need to reset your password to access your account. Find out more.
Forum Discussion
scotte_zinn
10 hours agoNew Contributor
ssh-agent not respecting OP_BIOMETRIC_UNLOCK_ENABLED
From another device, if I set OP_BIOMETRIC_UNLOCK_ENABLED=true in my shell, and then type `eval $(op signin)` then my desktop where 1P is running, pops up the biometric dialog to authenticate. This is correct and expected.
If I set OP_BIOMETRIC_UNLOCK_ENABLED=false and do the same command, now I get asked at the command-line for my vault password. This is also correct and expected.
I have enabled ssh-agent and `ssh-add -l` shows my key. Regardless of the OP_BIOMETRIC_UNLOCK_ENABLED setting, when I type `ssh hostname`, I get the dialog on my desktop prompting me to use my fingerprint. This is NOT correct.
If OP_BIOMETRIC_UNLOCK_ENABLED=false, `ssh hostname` should prompt for the vault password at the command-line. Futhermore, it `eval $(op signin)` has been executed and there is an active session, then I would expect the `ssh hostname` to just work and not require any authentication.
This essentially makes ssh agent only usable when at the desktop machine and not logged in to it remotely. The openssh ssh-agent works as expected.
From a developer point of view, I actually think what I want to happen is not likely possible since ssh is connecting to ssh-agent through the socket and has no awareness of the OP_BIOMETRIC_UNLOCK_ENABLED environment variable.
It would be really nice if this could work.
No RepliesBe the first to reply