Signing back into the Community for the first time? You'll need to reset your password to access your account.  Find out more.

Forum Discussion

scotte_zinn's avatar
scotte_zinn
New Contributor
10 hours ago

ssh-agent not respecting OP_BIOMETRIC_UNLOCK_ENABLED

From another device, if I set OP_BIOMETRIC_UNLOCK_ENABLED=true in my shell, and then type `eval $(op signin)` then my desktop where 1P is running, pops up the biometric dialog to authenticate. This is correct and expected.

If I set OP_BIOMETRIC_UNLOCK_ENABLED=false and do the same command, now I get asked at the command-line for my vault password. This is also correct and expected.

I have enabled ssh-agent and `ssh-add -l` shows my key. Regardless of the OP_BIOMETRIC_UNLOCK_ENABLED setting, when I type `ssh hostname`, I get the dialog on my desktop prompting me to use my fingerprint. This is NOT correct.

If OP_BIOMETRIC_UNLOCK_ENABLED=false, `ssh hostname` should prompt for the vault password at the command-line. Futhermore, it `eval $(op signin)` has been executed and there is an active session, then I would expect the `ssh hostname` to just work and not require any authentication.

This essentially makes ssh agent only usable when at the desktop machine and not logged in to it remotely. The openssh ssh-agent works as expected.

From a developer point of view, I actually think what I want to happen is not likely possible since ssh is connecting to ssh-agent through the socket and has no awareness of the OP_BIOMETRIC_UNLOCK_ENABLED environment variable.

It would be really nice if this could work.

No RepliesBe the first to reply