I got this working using @malo solution but it doesn't work when trying to use SSH signing with 1Password.

My workaround right now is to manually remove gpg.ssh.program from .gitconfig when connecting to the remote over SSH and then adding it again when using the remote computer in person.

We're considering to have op-ssh-sign check for SSH_TTY / SSH_CONNECTION and SSH_AUTH_SOCK, and if both are set, use SSH_AUTH_SOCK instead. That should remove the need for these SSH config and rc file snippets.

We'll keep this thread posted if we have any updates on this.

I'm also struggling with this and looking for a clean solution.

@mangus, have a look at the https://docs.blink.sh/advanced/advanced-ssh section of the Blink docs. If you want to use agent forwarding, you need to either use ssh -A or set ForwardAgent to YES in your Blink host config (config -> Hosts -> [host] -> SSH Config).

To get my Mac to use the forwarded agent when I connect to it over SSH with Blink, but still use 1Password when I'm working on my Mac locally I've been using the following in my ~/.ssh/config file:

ssh-config
Match host * exec "test -z $SSH_TTY"
IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"


This sets 1Password as the IdentityAgent only when $SSH_TTY isn't set, which is the case when I'm working locally on my machine. When I SSH in using Blink with agent forwarding, $SSH_TTY is set along with $SSH_AUTH_SOCK (which is used by any commands, e.g., git, to do SSH authentication).

Any suggestion on how to handle situations where $SSH_TTY or $SSH_AUTH_SOCK is not available? When I connect to my iMac from Blink shell for iOS I only have $SSH_CONNECTION available.

Hey everyone, thought i'd post my solution in case it helps anyone looking to setup agent forwarding with 1Password.

The solution was to rely on file paths instead of environment variables as most GUI apps don't have a way of setting environment variables.

Make both changes on the remote machine:
1. ~/.ssh/rc contents (don't forget to chmod +x this file):

```

create/update symlink only if interactive ssh login AND ~/.ssh/ssh_auth_sock doesn't exist AND $SSH_AUTH_SOCK does exist

if [[ -n "$SSH_TTY" && ! -S ~/.ssh/ssh_auth_sock && -S "$SSH_AUTH_SOCK" ]]; then
ln -sf $SSH_AUTH_SOCK ~/.ssh/ssh_auth_sock
fi
```

1. ~/.ssh/config contents: ``` # override IdentityAgent parameter for all hosts if forwarded SSH agent is present Match host * exec "test -S ~/.ssh/ssh_auth_sock" IdentityAgent ~/.ssh/ssh_auth_sock

use 1password ssh agent as default

Match host *
IdentityAgent /path/to/1password/agent.sock
```

Explanation

The ssh rc script runs everytime an ssh connection is made. It updates the symlink ~/.ssh/ssh_auth_sock with the path specified by $SSH_AUTH_SOCK, which is the path to the forwarded ssh agent.

The first match in the ssh config only succeeds if the symlink is valid, and if so, uses that as the IdentityAgent. If the first match fails, then IdentityAgent will be set to local instance of 1Password instead. The order is important – SSH will use the first obtained value for a parameter, so when the symlink is valid, it'll set it as the IdentityAgent and ignore the second IdentityAgent line.

Works when i'm locally at the machine and when connected via SSH – with both CLI and GUI apps!

I specify the forwarded agent explicitly when I need it (which is correctly set in the $SSH_AGENT_SOCK environment variable):

shell
ssh -o IdentityAgent=$SSH_AUTH_SOCK your.host.name


For git, this would be (solving the OPs question):

shell
GIT_SSH_COMMAND="ssh -o IdentityAgent=$SSH_AUTH_SOCK" git push


Background: The agent forwarding works fine, but the IdentityAgent setting in .ssh/config takes precedence over the SSH_AUTH_SOCK environment variable set by ssh. It seems to be possible to use environment variables in the .ssh/config file as well (specifically for the IdentityAgent setting), but I believe this won't work for non-terminal applications.

It's not perfect, but works for me.

HTH

I have the same issue, but because I'm using multiple SSH keys and I use the IdentityFile option as mentioned in the advanced config (https://developer.1password.com/docs/ssh/agent/advanced) to select a specific key to each server, I cannot use the snippet mentioned earlier in this thread because that gives me the error from the openssh agent:


Load key "<mykey>.pub": invalid format


Both the IdentityFile and the IdentityAgent options support environment variables, so I could create a mapping to set the IdentityFile for each host using env vars, and set it to an empty string if connecting over SSH, but with more than 50 entries in my ssh config and a separate key for each host, this makes my profile settings and ssh_config overly complex.

Is there anyone that found a better solution to work around this?

Today, I realized a shortcoming of the solution I posted https://1password.community/discussion/comment/644548/#Comment_644548. It doesn't work when calling ssh from non-interactive terminal sessions such as iTerm Profiles or other apps not launched from the terminal. In these cases, SSH_AUTH_SOCK is not set and 1Password is not used as the SSH Agent.

The ideal solution would be if OpenSSH had a way to configure multiple SSH Agents to use in priority order, but I'm not aware such a thing exists.

For the basic case of SSH Agent forwarding as asked by the OP, the solution I proposed works well for me.

This seems to work for me.

Instead of configuring 1Password's SSH Agent via ~/.ssh/config, I instead rely on the environment variable SSH_AUTH_SOCK. In my ~/.zshrc I do this:

```

Set SSH_AUTH_SOCK to use 1Password as SSH Agent when not ssh'd in remotely.

if [ -z $SSH_TTY ] ; then
SSH_AUTH_SOCK=~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock
fi
```

This gives me the behavior I'm looking for: when I'm working on my Mac locally (SSH_TTY is not set), the local instance of 1Password is used. When I'm ssh'd into my Mac remotely, the forwarded agent is used (I have ForwardAgent yes in my ~/.ssh/config as indicated in my previous post. This allows me to always use the 1Password instance running on my local Mac, even when ssh'd into another host remotely and that host may also be running 1Password.

I'm curious if there are other ways to accomplish this.

Cheers,
Michael

Update: oops. I had the logic reversed in my original post. fixed.