SSH Keys

[larena1]

bitwarden/server#4575

As this will be merged soon, is it planned to add support for SSH Keys to Vaultwarden as well?

@dani-garcia @BlackDex

[BlackDex]

Looks simple enough as far as i can tell. But i have not validated it yet.

[BlackDex]

The main other issue is the web-vault. There is no support yet for newer versions then 2024.6.2 in Vaultwarden yet. And it requires a specific version number to be used on the server side for it to work.

[larena1]

Do newer web versions require some new endpoints or why is that exactly?

[BlackDex]

The manager role has disappeared.
I'm working on a quick fix to use the custom role and have it backwards compatible in the database instead of migrating everything back and forward which will b cause issues somewhere in the end.

[larena1]

It seems you are more or less maintaining Vaultwarden alone at this point and @dani-garcia has stopped contributing. Would be a shame if Vaultwarden was abandoned but it feels a bit like it already.

[liszca]

Looks simple enough as far as i can tell. But i have not validated it yet.

Tried to save a ssh private key to a Custom Field of type "Hidden". Result was its not saved with the Newlines, if that's fixed or a type "Hidden Multi line" is added that would be good enough.

Alternative why not having Notes hidden by default? Also "Card" seems to be suitable for that task, no Problems with Multi liners here.

[larena1]

The feature has now also been added to the clients. Do you know if there's more to do to support the most recent client versions than just the manager role? Otherwise at some point it could also happen that Vaultwarden cannot be used at all anymore with up to date clients when it's already behind 6 months now, right?

[BlackDex]

Since we use Vaultwarden our self, we would of course thrive to get these features in.
There are probably some more features added or changed on how the web-vault works, and maybe some clients.

Those are not yet tested by me at least.

[dani-garcia]

This has been implemented today with #5187. It's usable only on desktop clients built from source now as long as you update the version and enable the required feature flags on the server.

The official release of the clients will be next month, if everything goes according to plan.

[svoop]

Perfect moment to say BIG THANKS for all your work on Vaultwarden @dani-garcia @BlackDex !!

[davidyannick86]

the desktop app is up to date but can't. see any option to add an ssh key I'm on mac nor on vaultwarden server or bitclient desktop

[jradwan]

What is this supposed to look like in the UI after enabling the options? I've got the options added and the latest desktop client (on Windows 11) but can't find anywhere would I would add or manage SSH keys. I can't find any screenshots or documentation that describe how this is supposed to work. Can someone nudge me in the right direction?

[rushout912]

What is this supposed to look like in the UI after enabling the options? I've got the options added and the latest desktop client (on Windows 11) but can't find anywhere would I would add or manage SSH keys. I can't find any screenshots or documentation that describe how this is supposed to work. Can someone nudge me in the right direction?

Go to settings and choose the "Enable SSH Agent" option :

If you also enabled the ssh-key-vault-item flag, you should see the new SSH Key item type :

[jradwan]

Thanks. I must be doing something wrong because I don't see that under Settings or the new Type. Running 1.32.7 in a Docker container on Synology. I'll keep poking ...

[jradwan]

Ok, maybe there's some sort of timing issue for the clients to "reconnect" and notice the config change? Because now suddenly I see the option in Settings and under Types. Thank you!

[ghost]

it would be nice to also support android (Termux)
termux/termux-app#4289 (comment)

[WRW001]

Hello! I have my desktop client updated to 2024.12.0, and I also have the EXPERIMENTAL_CLIENT_FEATURE_FLAGS configured. And I can use it generate new ssh-keys. But I am having issues with the key algorithm, the only algorithm supported is ed25519, it seems that there is no chance generate a RSA key or an ECDSA key, and also there is no chance to import any RSA/ECDSA key. Any solutions?

[WRW001]

@quexten

That said, is there a good use-case you have for RSA/EcDSA?

RFC 6187
X.509 Certificates can be used for both client and server authentication. This is the scenario in which RSA and ECDSA have widely been used.

[rushout912]

and also there is no chance to import any RSA/ECDSA key. Any solutions?

RSA keys are supported for import. However, some client (for instance putty) generate non-standard encodings (f.e using a 64 linewidth instead of 70), which needs an upstream dependency to be supported. Importing keys generated from openssh works though - even password protected ones.

@WRW001 which client did you generate/export your keys in?

That said, is there a good use-case you have for RSA/EcDSA? Both are cryptographically sub-par, compared to ed25519, and have both a higher risk of implementation vulnerability. For instance, the rsa crate, used in the ssh-agent, has unresolved timing sidechannels: RustCrypto/RSA#394 which could allow forging ssh signatures when you connect to a malicious server. That is to say, where possible, ed25519 should be used. I understand there is some legacy systems and embedded systems that do not yet support ed25519, so RSA is the alternative, discouraged, but still supported key type. I'm looking to hear about good use-cases though, because these strengthen the case for adding RSA to the generator instead of just allowing import.

Sorry for bumping into discussion, is password encrypted ssh key import supported in current client versions (2024.12.0)? When I tried to import such keys, client asked me to enter the password for the SSH key, I typed the password, and then client said the SSH key is invalid. I checked the key's linewidth and I'm sure it has 70 linewidth, which is OpenSSH format.

[WRW001]

@rushout912 Are you using the ECDSA key? It is currently totally unsupported. A 70-linewidth RSA or ED25519 key seems OK.

[quexten]

Sorry for bumping into discussion, is password encrypted ssh key import supported in current client versions (2024.12.0)? When I tried to import such keys, client asked me to enter the password for the SSH key, I typed the password, and then client said the SSH key is invalid. I checked the key's linewidth and I'm sure it has 70 linewidth, which is OpenSSH format.

I'd also recommend creating a GitHub issue on the upstream bitwarden/clients. It would especially be helpful to have test keys, or the application they are generated in.

[WRW001]

@quexten A new issue has been filed on the upstream bitwarden/clients.
bitwarden/clients#12412

[foux]

I've enabled the SSH-Agent on macOS, but it won't look to bitwarden keys. Is there a next step to enable the ssh-agent?
Thanks

[quexten]

In that case it is fixed by this PR: bitwarden/clients#12371

[foux]

Thanks a lot, and sorry for the time wasted testing a wrong issue.

[lionep]

Thanks! Same for me, agent forwarding is enabled

[svoop]

For mac and linux you need to put SSH_AUTH_SOCK=/{MY_USER_HOME_DIR}/.bitwarden-ssh-agent.sock (putting in your home directory, in your environment variables.

Some terminal apps like iTerm or Wave SSH directly without sourcing .zprofile where this environment variable might be set. Therefore, a maybe better way to set the socket is in ~/.ssh/config:

Host *
    IdentityAgent ~/.bitwarden-ssh-agent.sock

This way, you can also use Bitwarden for some hosts and another agent of other hosts. (Don't really see any reason why, but hey, you could. 😄 )

[smile2008]

Hi, on macOS
I done
export SSH_AUTH_SOCK="${HOME}/.bitwarden-ssh-agent.sock"
and all seems to be ok:

ssh-add -l
256 SHA256:76pY7ubsXPBs65VcaiGB5FHE5f1aFpQuw8He1fz0CtY Test server (ED25519)

When I try to ssh, I got popup in client, hit allow button and.....
got this error:
sign_and_send_pubkey: signing failed for ED25519 "Test server" from agent: agent refused operation

Please tell me how repair this(

[nyawox]

i want to thank you for all the work put on this feature, for both upstream and vaultwarden contributors!
I'm daily driving this (although admitelly i had to run a "patched" bitwarden desktop with cherry-picked prs, packaged desktop_proxy for nix and replaced nord with custom theme)
it's already been few weeks and i didn't have any issue on the backend until now, running flawlessly.
the only nice to have qol feature i see lacking today is on the client side, which might be possible after https://redirect.github.com/bitwarden/clients/pull/12371
but other than that, i think it's safe to say it's mature enough to rely on as ssh key storage, or even better, you could add pam_rssh to avoid reusing memorable user passwords across deployed machines.

[arpanghosh8453]

Hello! This looks like an amazing feature. I do see the SSH key subtype in the browser extension, but can't add any there. Inside the add option, there is to SSH key field.

I have added the following in the experimental flag. Server is latest docker container.

EXPERIMENTAL_CLIENT_FEATURE_FLAGS=fido2-vault-credentials,ssh-key-vault-item,ssh-agent

I am using Bitwarden official clients Version: 2025.1.0 for Extension as well as Desktop app.

Web app (No SSH key addition possible):

Browser Extension shows the SSH keys in type:

Browser Extension unable to add any SSH keys:

What I am missing here? @dani-garcia @BlackDex

[BlackDex]

I think patients. Most of the clients which have full support have just been released. And some clients cache the response of the config endpoint for a while.

The web-vault doesn't support it yet unless you use the trading i tagged releases.

[quexten]

Generating ssh keys in the extension is only supported from 2025.1.1 onwards, same thing goes for the web vault.

[arpanghosh8453]

Thank you @BlackDex . I used the Windows store earlier which installed 2025.1.0. Now I updated that to 2025.1.2 with manual install and it looks like working in the Desktop client. Thank you for the superfast reply! Love Vaultwarden!