SSH-agent: allow specifying/limiting private key offers

Feature Requests Password Manager
,
20

My additional two cents, that I already mentioned here: https://serverfault.com/questions/401737/choose-identity-from-ssh-agent-by-file-name/1197632#1197632

First: For windows users a rudimentary equivalent of the scripts above to export all public keys as a short powershell command:

mkdir ~/.ssh/fingerprints
ssh-add -L | %{echo "$_" | Out-File -Encoding utf8 "~/.ssh/fingerprints/$(("$_" -split ' ' | select -skip 2) -join ' ').pub"}

Then as it’s annoying to manually add all the pub files to ~/.ssh/config, you can do this via wildcard and placeholder tokens. Under the assumption, that all you public keys are named username@hostname.pub, use a ~/.ssh/config like this:

Host *
	IdentityFile ~/.ssh/id_rsa
	IdentityFile ~/.ssh/id_ecdsa
	IdentityFile ~/.ssh/id_ecdsa_sk
	IdentityFile ~/.ssh/id_ed25519
	IdentityFile ~/.ssh/id_ed25519_sk
	IdentityFile ~/.ssh/fingerprints/%r@%h.pub
	IdentitiesOnly yes

The static files without placeholders are just the default identity filenames, remove if you don’t need/use them.

Placeholder %r is the remote username and %h is the host.

This way I can just add a new key named e.g. root@host.example.com to bitwarden, execute the above powershell snippet once, and then ssh root@host.example.com will use the key.

1 Like