CLI command
skarbiec ssh add
Use an SSH key the vault keeps without ever writing it to a file: the key goes from the decrypted item through a pipe into the running ssh-agent.
Invocation#
skarbiec ssh add <item-id> [--lifetime <seconds>] [--agent <socket>]
skarbiec ssh add --tag <tag> [--lifetime <seconds>] [--agent <socket>]Purpose#
Use an SSH key the vault keeps without ever writing it to a file: the key goes from the decrypted item through a pipe into the running ssh-agent.
Required inputs and options#
- One item id whose private_key field holds the key, usually a key-pair item, or --tag naming a tag whose live items' keys all go. --agent names the agent's socket; without it SSH_AUTH_SOCK does, as for ssh-add. --lifetime <seconds> is handed to ssh-add's -t, so the agent drops the key after that long. A key stored with a passphrase is asked for by ssh-add on the terminal; without a terminal ssh-add refuses it.
Output and state effects#
- Runs ssh-add - with the key on standard input, appends an ssh-add journal record naming the item and the lifetime (never the key), and prints ok, item, agent, lifetime_seconds and ssh-add's own line. With --tag it does that for every live item carrying the tag, one by one, and prints ok (true only when every key loaded), tag, added (each key's answer) and refused (each item whose key did not load, with why); one refusal does not stop the others. The key never reaches a disk, stdout or the journal. POST /v1/operator/items/ssh-add takes id or tag, agent and lifetime; Desktop's Add key to SSH agent in the item inspector, and Add every key tagged under Settings → Policy's Tags, send the socket of its own session.
Refusals#
- Neither an id nor --tag, or both, exits 2 with `usage: ssh add <item-id> | ssh add --tag <tag> [--lifetime <seconds>] [--agent <socket>]`, and an --lifetime that is not a whole number exits 2 with `--lifetime <value> is not a whole number of seconds`. Refuses when neither --agent nor SSH_AUTH_SOCK names a socket, an item without private_key text with `<id> holds no private_key text, so there is no key to add`, an ssh-add that rejects the key with `ssh-add refused the key of <id> (<status>): <its words>`, and a tag no live item carries with `no live item carries the tag <tag>, so no key was added`.