0

I am completely lost here.

I found out about storing ssh private keys (of which I have a lot of) in my keepass database. Before I had a bash script with a simple menu that would just use ssh -i and get the priv key file locally from the .ssh directory. The end goal here is to make a centrally available database of both passwords and private keys to utilize across different devices.

I have since put all my ssh private keys in my keepass database and I am trying to figure out how to integrate keepass/keeagent with the bash terminal.

But I think I have misunderstood what keepass can actually do. What I want to do is open my keepass database, run my existing bash script and be able to bring up an ssh session that way.

I've been trying to look into using ssh-agent, but I have actually no idea what I am doing there or how that operates. All the information I find online is walking through steps way above me or options that don't use the terminal.

So, is there a way I can run a command like this: ssh -i KEEPASS-DB-PRIVKEY user@ip or is that just not a capability of keepass/keeagent/sshagent?

I am on ubuntu 20.04 with KDE plasma as desktop. I have keepass2 (2.44) with keeagent plugin installed.

Improve this question

2 Answers 2

Reset to default
2

I think I got it pretty consistent now. Tested with a fresh boot and it works. But with a big caveat.

I first edited the keeagent options as follows:

  • Agent mode: Agent
  • Path: /home/$USER/.ssh-keeagent.sock

I then I added the line to .bashrc: export SSH_AUTH_SOCK="/home/$USER/.ssh-keeagent.sock"

I'm pretty sure ssh-agent is started automatically on boot (pretty sure I did that by accident), which is handling the keys for openssh.

The big caveat here is that ssh isn't smart about the keys that it has loaded. So if you loaded a whole bunch of keys and wanted it to use the last key in the list, the server at the end would deny you because you tried to use all the other keys in the list first. I assume this is because there is no way ssh knows what key is associated with what IP.

Perhaps this can be avoided by using .ssh/config. But I haven't messed with that yet.

But as long as its a single key loaded in, I can open a terminal and type ssh user@IP and it connects. I even get the little notification from keepass that a key was used in another application.

If anyone already has an idea for ensuring ssh only uses a specific key for an IP while keeping the actual keys in the keepass database, I would love to hear it.

It looks like I was able to solve the problem by using public keys in ~/.ssh/config under IdentityFile.

Host hostname
        Hostname IP
        User user
        IdentityFile ~/.ssh/key.pub
        IdentitiesOnly yes

With all the keys loaded, shown in ssh-add -l I can simply call a host ssh hostname and it picks the correct private key based on the public key called in config.

Improve this answer
3
  • Since you've resolved your issue, please don't hesitate to accept your answer. That'll mark it as containing a solution, and removes it from the Unanaswered -queue.
    – Peregrino69
    Sep 27, 2021 at 12:03
  • I believe you should be using the private key in the identity file, not the public key. I have used public keys in my config before, but the SSH client will sometimes decide that the public key permissions are too lax, and will not connect.
    – arcanemachine
    Mar 17, 2022 at 20:16
  • You can use the public key in the identify file. Just chmod 600 the public key and the agent won't complain. Its kinda funny, I never would have thought the public key could work as an identifier for ssh-agent private key.
    – user432564
    Mar 18, 2022 at 14:16
0

It won't work with openSSH client. It's designed to be used with GUI applications like PuTTy or KiTTy, where you choose keyfile by browsing; Windows-style.

If you're willing to switch applications, you can also install PuTTy for Linux. That should work the same way - the only way to know is testing, as all available instructions I found with a quick search refer to Windows.

Improve this answer
2
  • 1
    I actually just got it to work a second ago with keeagent in agent mode. Both putty and the terminal were able to use ssh user@ip and just work. I was throwing crap at the wall though, so I am retracing my steps to see what I did.
    – user432564
    Sep 18, 2021 at 18:28
  • LOL :-D Once you get it working, please do write an answer to your own question with step-by-step instruction. I've been using KeePass for almost a decade and never found out how to use it with a terminal SSH client :-D
    – Peregrino69
    Sep 18, 2021 at 18:31

You must log in to answer this question.