Use an SSH agent (1Password, Bitwarden and others)

The desktop app can log in with the keys of an SSH agent running on your computer, the way ssh does. The keys stay in the agent; Sternway only asks it to sign each login. Besides the agent your terminal uses, it finds the agents of 1Password and Bitwarden by itself, and takes any other agent’s socket or pipe you name.

The phone app has no agent setting: Android has no SSH agent to ask. On the phone, keep the key in Sternway’s Keychain or on a security key.

Turn it on

1. Open Settings › Connections & SSH and, under SSH agent, turn on Use this computer’s SSH agent. Every host then also offers the agent’s keys, next to the key or password it has in Sternway.

2. Choose the agent:

   Choice	Linux	macOS	Windows
   System agent (SSH_AUTH_SOCK)	$SSH_AUTH_SOCK	$SSH_AUTH_SOCK	\\.\pipe\openssh-ssh-agent (or $SSH_AUTH_SOCK when set)
   1Password	~/.1password/agent.sock	~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock	\\.\pipe\openssh-ssh-agent
   Bitwarden	~/.bitwarden-ssh-agent.sock, then the Snap and Flatpak places	~/.bitwarden-ssh-agent.sock, then the Mac App Store place	\\.\pipe\openssh-ssh-agent
   Custom socket or pipe…	the path you type under Agent socket or pipe	the same	the same

   Each choice says whether its agent is running.

3. Choose Test. Sternway lists each key the agent holds, with its fingerprint, type and comment (1Password and Bitwarden put the item’s name there). It never shows or copies a key.

On Windows, 1Password and Bitwarden both serve the system OpenSSH agent pipe, so all three choices reach the same agent there.

Agent socket or pipe takes only a socket or pipe on this computer: a full path such as /run/user/1000/gnupg/S.gpg-agent.ssh, or a Windows named pipe. A network address or a pipe on another computer is refused.

These settings belong to this computer and are not synced.

Turn on the agent in 1Password

• Mac and Linux: in 1Password, open Settings › Developer and select Use the SSH Agent. To keep it running with the window closed, keep 1Password in the menu bar or system tray (Settings › General). 1Password’s agent does not work with its Flatpak or Snap packages for Linux.
• Windows: first stop the OpenSSH Authentication Agent service and set its startup type to Disabled (services.msc), then select Use the SSH Agent in 1Password.

By default 1Password offers the keys of your Personal, Private or Employee vault; keys in other vaults need its agent.toml file. See 1Password’s own guide, Get started with 1Password for SSH.

Turn on the agent in Bitwarden

In the Bitwarden desktop app, open Settings and turn on Enable SSH agent. On Windows, disable the OpenSSH Authentication Agent service first, as above. The agent runs only while you are logged in to Bitwarden. See Bitwarden’s guide, SSH Agent.

What happens when you log in

• Sternway asks the agent for its list of keys, offers them to the server, and asks the agent to sign the server’s login challenge with the key the server takes. Only that signature reaches the server.
• 1Password and Bitwarden show their own approval window. The connection waits for your answer, and the wait does not count against the connect timeout. If you refuse, the next way of logging in (another key, the password) is tried.
• Servers allow only so many keys to be offered (OpenSSH: six by default). With many keys in the agent, a server can refuse the connection before the right key’s turn. Give the host its own key in Sternway, or limit what the agent offers.

Agent forwarding forwards Sternway’s keys, not the agent’s

The Agent forwarding setting (in Settings, or per host) forwards Sternway’s own keys to the server you log in to: the key the login used, or all the keys the host and its jump hosts have in Sternway. It never forwards the SSH agent. A key that lives only in 1Password or Bitwarden can therefore not be used from that server. If you need that, run ssh -A from a terminal, which forwards the agent itself, and keep in mind that anyone with administrator rights on that server can then ask your agent to sign while you are connected.

What was checked

The vendor choices were checked against the socket and pipe paths the vendors document and against test agents serving those paths, not against the real 1Password and Bitwarden apps. Their approval windows were stood in for by a test agent that waits before it signs. The Windows and macOS paths are checked by unit tests only.