Using KeePassXC with SSH-Agent on OpenBSD
I’m using KeePassXC to manage my secrets. But when I log into my OpenBSD laptop, I’m still asked to enter my SSH passphrase to fill-in ssh-agent(1). Somehow, it’s great ; maybe other system don’t even propose that feature out of the box. But what if KeePassXC could know about my passphrase(s) and interact with ssh-agent(1). Well, it can.
Run ssh-agent(1)
On OpenBSD, ssh-agent(1) is natively run when you log in via xenodm. Then ssh-add(1) is called if you have any SSH keys.
Half the work is already done. Simply disable ssh-add(1) ; when required, your keys shall be managed by KeePassXC.
--- /etc/X11/xenodm/Xsession.orig Mon Oct 5 02:47:52 2020
+++ /etc/X11/xenodm/Xsession Sun Jan 9 14:28:27 2022
@@ -33,7 +33,7 @@
if [ -x /usr/bin/ssh-agent ] && [ -f $id1 -o -f $id2 -o -f $id3 -o -f $id4 -o -f $id5 ];
then
eval `ssh-agent -s`
- ssh-add < /dev/null
+ #ssh-add < /dev/null
fi
fi
If you were not using OpenBSD and/or xenodm, you’d have to run
eval `ssh-agent -s` somewhere during your X session.
Configure KeePassXC
Start KeePassXC and and select the Tools / Settings menu.
Click the “SSH Agent” icon and check the “Enable SSH Agent integration” option. If ssh-agent(1) is started properly, you’ll get an ack message.
Register the SSH keys
Close the settings window and “Add a new entry” to KeePassXC.
Enter a descriptive “Title” ;
Enter your passphrase in the “Password” field ;
Scroll down to “SSH Agent” and click on the option ;
Configure the key management policy you’d like to apply ;
☑ Add key to agent when database is opened/unlocked ;
☑ Remove key from agent when database is closed/locked ;
☑ Require user confirmation when this key is used ;
▢ Remove key from agent after 600 seconds.
In the “Private Key” section, click the “Browse” button to select your SSH private key. Then click the “Add to agent” button. And select you SSH key file.
Click the “OK” button to save your settings.
Usage
From now on, simply unlock KeePassXC and connect to the remote host using SSH. You shall get a confirmation message if you’ve configured it. And you’ll be automagically logged in.
Done!