Keys in 1Password, Bitwarden and other SSH agents

Your SSH keys can stay in 1Password, Bitwarden, KeePassXC or Secretive. MorphGate signs in with them through the password manager's SSH agent, so the private key never enters MorphGate's vault. This works on Linux and macOS; on Windows, use a key in the vault for now (see SSH keys and host keys).

How it works

In a host or identity, choose SSH agent as the sign-in. MorphGate asks the agent that $SSH_AUTH_SOCK points to for its keys and offers them to the server one by one. The password manager may ask you to approve each use.

So the one thing to set up is SSH_AUTH_SOCK, pointing at your password manager's agent, in the environment MorphGate starts in. MorphGate started from the dock or the applications menu does not read the export lines in your shell's profile: set it for your desktop session, as below, or start MorphGate from a terminal where it is set.

Set it up

1Password

  1. In 1Password, open Settings → Developer and turn on Use the SSH agent. Add or import your keys as SSH key items.
  2. The agent's socket is ~/.1password/agent.sock on Linux, and ~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock on macOS.

Bitwarden

  1. In the Bitwarden desktop app, open Settings and turn on Enable SSH agent. Add or import your keys as SSH key items.
  2. The agent's socket is ~/.bitwarden-ssh-agent.sock for most installs. The Mac App Store, Flatpak and Snap versions keep it elsewhere; Bitwarden's help pages list the paths.

KeePassXC

Turn on Settings → SSH Agent → Enable SSH Agent integration, and in each entry with a key, Add key to agent when database is opened. KeePassXC hands its keys to the agent your system already runs, so SSH_AUTH_SOCK usually needs no change.

Secretive (macOS)

Secretive keeps keys in your Mac's Secure Enclave. Its socket is ~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh.

Point MorphGate at the agent

Linux

On most distributions, a file in ~/.config/environment.d/ sets a variable for the whole desktop session. For 1Password, create ~/.config/environment.d/ssh-agent.conf with:

SSH_AUTH_SOCK=${HOME}/.1password/agent.sock

Sign out and back in, then start MorphGate. If your desktop's own keyring sets the variable after this, start MorphGate from a terminal instead: SSH_AUTH_SOCK=~/.1password/agent.sock morphgate.

macOS

In Terminal, give the socket to apps you start from now on, then quit and reopen MorphGate:

launchctl setenv SSH_AUTH_SOCK ~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock

This lasts until you restart the Mac. To keep it, run the same command from a login item or a launch agent; 1Password's developer documentation has a ready-made one.

Check it

In a terminal, with the same SSH_AUTH_SOCK, ssh-add -l lists the keys the agent offers. If it shows your keys, MorphGate sees them too.

Good to know

  • Too many keys: servers usually stop after about six failed keys ("Too many authentication failures"). If the agent holds many keys, limit which ones it offers: 1Password and Bitwarden can restrict their agent to chosen items, and KeePassXC only adds the entries you tick.
  • Sync: a host set to SSH agent syncs as it is. On another device, that device's agent has to hold the key.
  • Teams: a shared host can use the agent too; each member signs in with a key from their own password manager.