Can I configure KeePassXC to prompt for unlocking if a process attempts to use an ssh key?

[RensOliemans]

I'm using KeePassXC as an ssh-agent. This works perfectly, ssh-add -L shows my ssh keys whenever I have KeePassXC unlocked. When it's locked, I see this:

ssh-add -L
The agent has no identities.

which is good. What I would want is that when I do ssh host and KeePassXC is locked, that the password prompt to unlock KeePassXC pops up, I enter the password, and then the ssh command goes through. Is this possible?

[droidmonkey]

You would have to script that behavior and replace your ssh-add with that script. Basically it would check if the identity requested was listed, if not it opens keepassxc and waits.

Would be a neat/beast experiment but probably lots of fringe issues with that as the ssh workflow is not meant to be like that.

[RensOliemans]

Thanks. If I end up scripting this and it works, is it something that can be incorporated into keepassxc at some point? Or is it entirely outside keepassxc?

I'm thinking of roughly the following steps, am I understanding this right?:

• replace ssh with my own script, which does this:
• check known_hosts
• if key is not listed (in ssh-add -L), open keepassxc (probably via some dbus commands that keepassxc listens to? I have no idea)
• when keepassxc is opened, call the regular ssh command.

If so, I think you're right in that it's a beast, I won't then do this 😅.

I saw this behaviour on someone else's machine, Windows & Bitwarden (but it seems to work on Linux as well, per their docs). They attempted to ssh and a bitwarden prompt arose requesting for authorization. They certainly didn't replace their ssh-add script, it was more built-in (see https://bitwarden.com/help/ssh-agent/#enable-ssh-agent or https://community.bitwarden.com/t/ssh-agent-dont-prompt-for-authorization-when-vault-is-unlocked/80435/5). Do you have any clue how that's done?

[droidmonkey]

Lol I meant "neat" not beast. Silly auto correct.

This would be something always outside keepassxc since we just load keys into the agent and dont interact with downstream consumers at all.

Bitwarden acts as the ssh agent itself, if I am not mistaken. We decided to not go that direction since its not very cross platform portable (although maybe more so recently due to Microsoft convergence).

[RensOliemans]

Alright thanks for the clarification. I'll keep this in low prio since I don't know anything about ssh internals (other than what's necessary to understand ssh -v when things go south) and thus it's probably a bit more than half an hour of shell scripting. But if I get to it I'll definitely post my script here for reference.

[RensOliemans]

One more question: how do I open the keepassxc vault this way? Akin to what the browser plugin does when you press reload.

[droidmonkey]

You can either call KeePassXC executable directly and the existing instance will come into focus, or you can use a dbus call but that will ONLY work if KeePassXC is already running.