SSH Feature questions

I followed the instruction as well, but cannot get it to work. Imported my key, moved it out of .ssh and added export SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock to my shell and I get the following error.

shell
Thu 24 10:39pm in ~
•100% ▶ ssh -T git@gitlab.com
git@gitlab.com: Permission denied (publickey,keyboard-interactive).


I followed the instruction as well, but cannot get it to work. Imported my key, moved it out of .ssh and added export SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock to my shell and I get the following error.

shell
Thu 24 10:39pm in ~
•100% ▶ ssh -T git@gitlab.com
git@gitlab.com: Permission denied (publickey,keyboard-interactive).


@kevinneufeld And what do you get when you run:

SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock ssh-add -l


@floris_1P I get:
shell
Mon 28 9:01am in ~
⇣94% ▶ SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock ssh-add -l
The agent has no identities.


Is the SSH key you imported in a Private vault or a shared vault?

it is in a private vault specifically for work

when I move the key back to the personal vault I get the valid output:
shell
Mon 28 8:26pm in ~ took 1m 51s
•100% ▶ SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock ssh-add -l
256 SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (ED25519)


Is there a way to target addtional/other vaults?

@floris_1P

I'm really sorry but this is not making any sense to me.

In your documentation, you state:

"On Mac and Linux, add the IdentityAgent to your config file or set the SSH_AUTH_SOCK environment variable."

and

"Add the IdentityAgent snippet to your ~/.ssh/config file:

Host *
IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"

Or set the SSH_AUTH_SOCK environment variable in the shell where your SSH command runs:

export SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock
"

You explicitly say the word "or" twice. This indicates that the user has to do one OR the other.

If you HAVE to do both then surely the documentation needs to be updated. I run ssh-add -l and it fails to show any keys.

If I am misunderstanding then that's fine, but please ensure your documentation is cleared up and everything clarified to ensure misunderstandings like this don't happen.

Please could you explain again here so I can try to understand.

I was having trouble with this too and got it working. I had originally created an ssh key in my "Work" vault (not shared with anyone, but I don't think it counts as private), and was bemused as to why ssh -v was failing and claiming the agent had no identities.

Moving the key to the Personal vault fixed it. I can ssh hostname and 1Password prompts me for permission to connect, easy peasy.

@rctneil IdentityAgent is a way to override the SSH_AUTH_SOCK variable. It lets you instruct SSH to use a different ssh-agent for particular hosts, while SSH_AUTH_SOCK is the default. If 1Password is the only ssh-agent you're running, you can export SSH_AUTH_SOCK=<that long path> as suggested and that should work fine. No need to set IdentityAgent at all.

In my case I'm already running a different agent on SSH_AUTH_SOCK. So I set up my ~/.ssh/config file like this for 1PW:

```config
Host somethingtouse1passwordfor
HostName 123.456.78.910
User username
Port 42
IdentityAgent ~/.1password/agent.sock // symlink to the full socket path

Host *
IdentityFile ~/.ssh/my-normal-id
AddKeysToAgent yes
``
Note that in this case,ssh-add -lonly shows the keys in my default agent, NOT what's in the 1PW agent. The reason for this is thatssh-addlooks atSSH_AUTH_SOCK` to get the socket through which to communicate with an agent. If I want to see what's saved in the 1PW agent, I need to change the environment variable. I can do this temporarily for my current shell session like so:


SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock

And then ssh-add -l will report the key(s) from 1PW.

The documentation kind of assumes someone already knows how this works, which is probably a mistake given how arcane SSH can be and how minimal the usual instructions are that people get from github, web hosts, etc. If anyone wants to read a genuinely good explanation of what's going on, https://yayimorphology.org/ssh-identities-made-easy.html saved me a lot of headaches.