Using Bitwarden as your SSH Agent with an SSH config file

blog
1

If you SSH into servers and authenticate to Git remotes with SSH, you probably have SSH keys stored on your local machine, and you are probably slightly uncomfortable about this. It doesn’t seem quite right, when we are claiming that SSH keys are ‘more secure’, to just have them lying about on your machine.

I found out only quite recently that Bitwarden has the ability to hold SSH private keys in your vault, presenting those keys when needed for SSH authentication, without the keys ever leaving Bitwarden.

This means we can have the convenience of SSH key auth, but with the actual keys being held in your Bitwarden vault. The point-and-click relative ease of creating new keys in Bitwarden makes it quite easy to get into the habit of having single-purpose keys for each server or service, which is another good security practice.

While the setup is straightforward, there isn’t anything in the Bitwarden docs about using an SSH config file to make it work smoothly with multiple servers, and very little when searching the web, so I thought I’d write up a quick guide to how I set it up and got it working with my servers.

Assumptions / Prerequisites

  • You need a Bitwarden account.
  • The Bitwarden Desktop app should be installed on your machine.
  • You will need SSH access to a server for testing.

Create an SSH key in Bitwarden

Open the Bitwarden app, authenticate if needed, and click the “Add item” button. Choose a name that describes the purpose of the key, e.g. myserver.example.com.

Bitwarden will generate a new ed25519 keypair for you, and store the private key in the vault.

Tip: Name your keys with a consistent naming scheme, because we are going to want to refer to them later in the setup.

SSH keys get their own type in the Bitwarden vault. You can also import existing private keys by pasting them into an SSH key item via the desktop app, which makes migrating existing keys easy. Keys are available immediately via the SSH agent once stored.

Enable Bitwarden SSH Agent on your machine (macOS / Windows / Linux)

In Bitwarden Desktop, go to Settings > SSH Agent and toggle it on.

This makes Bitwarden expose an SSH agent socket that tools like ssh, ssh-add, and Git can use.

Test: Open a new terminal and run:

ssh-add -L

You should get a list of your public keys that are stored in Bitwarden.

If you get “Could not open a connection to your authentication agent” or “Error connecting to agent: Connection refused”, check that Bitwarden is running, and restart your shell session to pick up the Bitwarden agent socket (SSH_AUTH_SOCK). The Bitwarden docs cover OS-specific setup.

Linux flatpak note

If you installed Bitwarden as a Flatpak, the agent socket lives at:

~/.var/app/com.bitwarden.desktop/data/.bitwarden-ssh-agent.sock

To make this available to all apps (including GUI apps like VS Code that don’t inherit your shell environment), create ~/.config/environment.d/ssh-agent.conf:

SSH_AUTH_SOCK=/home/YOUR_USER/.var/app/com.bitwarden.desktop/data/.bitwarden-ssh-agent.sock

This is picked up by systemd user services and by Wayland compositors at login.

Create a public key file

Bear with me, yes I do mean public key file. SSH chooses keys per server using the IdentityFile in ~/.ssh/config, but since our private keys live in Bitwarden, we give SSH a public key file that matches the key in the vault. ssh then asks the Bitwarden agent for the corresponding private key, and the private key itself never leaves Bitwarden - the public key file is just a reference.

Create a file in ~/.ssh with the same name as your server, but with a .pub extension, e.g. ~/.ssh/myserver.example.com.pub.

Copy the public key from Bitwarden’s UI into that file. You can get the public key from the Bitwarden app by clicking on the SSH key item, and copying the “Public Key” field, and paste it into the new file.

Make SSH use the Bitwarden agent (via ~/.ssh/config)

If you are used to using ssh with a config file, you will have entries like this for your servers:

Host myserver
  HostName myserver.example.com
  User ubuntu
  IdentityFile ~/.ssh/id_rsa

To make SSH use the Bitwarden agent instead of a local key file, point IdentityFile at the public keyfile from the preceding step:

Host myserver
  HostName myserver.example.com
  User ubuntu
  IdentitiesOnly yes
  IdentityFile ~/.ssh/myserver.example.com.pub
  • IdentitiesOnly yes helps avoid “too many authentication failures” if you have lots of keys available.

Add the public key to your server, and test

Copy the public key from Bitwarden’s UI into the correct user’s ~/.ssh/authorized_keys on the server you want to log into, then run:

ssh myserver

If it works, you’re in.

If not, run with debug output:

ssh -vvv myserver

which will show which authentication methods and identities are being attempted. You should see that the agent is being used, and the correct key is being offered.

Agent forwarding (use your keys from inside an SSH session)

This is useful if you:

  • SSH into a server and need to git pull from GitHub there
  • hop from server A to server B (jump host style) while still using your local Bitwarden-held keys

Enable forwarding for specific hosts (recommended)

In ~/.ssh/config, for the servers where you want this:

Host myserver
  HostName myserver.example.com
  User ubuntu
  ForwardAgent yes
  IdentitiesOnly yes
  IdentityFile ~/.ssh/myserver.example.com.pub

Now SSH in:

ssh myserver

On the remote machine, check:

ssh-add -L

If forwarding is working, you’ll see your keys listed on the remote machine, even though the private keys remain in Bitwarden on your local machine.

Security note: only forward your agent to machines you trust. Forwarding gives that remote machine the ability to use your agent while you are connected.

GitHub over SSH (secondary setup)

Once server SSH is working, adding GitHub is straightforward.

In GitHub:

Settings → SSH and GPG keys → New SSH key

Paste the contents of your *.pub file.

For predictable key selection, add this block to ~/.ssh/config:

Host github.com
  HostName github.com
  User git
  IdentitiesOnly yes
  IdentityFile ~/.ssh/github.com.pub

Test:

ssh -T git@github.com

Then test a Git operation:

git clone git@github.com:OWNER/REPO.git

(or git fetch, git push in an existing repo)

References

2

A handy companion script for this setup: it finds a public key in the Bitwarden SSH agent by exact comment match and writes it into ~/.ssh as a ready-to-use .pub file.

#!/usr/bin/env bash
set -euo pipefail

if [[ $# -ne 1 ]]; then
  echo "Usage: $(basename "$0") '<exact ssh key comment from ssh-add -L>'" >&2
  exit 2
fi

comment="$1"

slugify() {
  printf '%s' "$1" \
    | tr '[:upper:]' '[:lower:]' \
    | sed -E '
        s/[[:space:]]+/-/g;
        s/[^a-z0-9._-]+/-/g;
        s/-+/-/g;
        s/^-|-$//g
      '
}

slug="$(slugify "$comment")"
out="$HOME/.ssh/${slug}.pub"

mkdir -p "$HOME/.ssh"
chmod 700 "$HOME/.ssh" 2>/dev/null || true

# Ensure agent is available
if ! ssh-add -L >/dev/null 2>&1; then
  echo "Error: ssh-agent not available or no keys exposed." >&2
  exit 3
fi

tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT

# Exact comment match (Bitwarden style, spaces allowed)
ssh-add -L | awk -v want="$comment" '
  {
    c=""
    for (i=3; i<=NF; i++) c=c (i==3 ? "" : " ") $i
    if (c == want) { print; found=1; exit }
  }
  END { exit found?0:1 }
' > "$tmp" || {
  echo "Error: No public key found with comment exactly:" >&2
  echo "  $comment" >&2
  exit 4
}

install -m 600 "$tmp" "$out"

echo "Wrote: $out"
echo "Fingerprint:"
ssh-keygen -lf "$out"

Usage

./bw-ssh-pubkey-export.sh <PUBKEY-NAME>
3

This topic was automatically closed after 60 minutes. New replies are no longer allowed.