KeePass: SSH keys passwords storage and decryption on Linux
Tags: linux, security, encryption, ssh
Published: 2019-12-13 12:33:08

---
title: KeePass: SSH keys passwords storage and decryption on Linux
published: true
date: 2019-12-13 08:32:44 UTC
tags: Linux,security,encryption,ssh
canonical_url: https://rtfm.co.ua/en/keepass-ssh-keys-passwords-storage-and-decryption-on-linux/
---

![](https://rtfm.co.ua/wp-content/uploads/2019/12/keepass-logo-1.png)As a follow-up to the [SSH: RSA keys, and ssh-agent for SSH keys and their passwords management](https://rtfm.co.ua/en/ssh-rsa-keys-and-ssh-agent-for-ssh-keys-and-their-passwords-management/) post.

The idea now is to make simpler to work with password-protected SSH keys, to avoid the necessity to enter a password each time when you want to load a key to the `ssh-agent`.

One of the possible solutions is to use KeePass, which will store keys and their passwords and will decrypt keys before load them to the `ssh-agent`.

To achieve this – we need in three components – an ssh-client (`ssh`, `ssh-add`, `git`, etc), the [KeePass](https://wiki.archlinux.org/index.php/SSH_keys#KeePass2_with_KeeAgent_plugin) itself with a [KeeAgent](https://lechnology.com/software/keeagent/) plugin, and the `ssh-agent` which will keep unencrypted files to pass them to clients.

In the examples below the KeePassXC will be used instead of vanilla KeePass, but there is no difference in their configuration (the only difference here is that KeePassXC already has the plugin installed).

In total, the workflow looks like next:

1. an `ssh-agent` is started, creates a UNIX-socket for communication with other components
2. KeePass is started, where are keys and their passwords are stored, and KeePass will decrypt keys and push them to the ssh-agent using its UNIX-socket
3. any ssh-agent is started, connects via the same socket to the ssh-agent, gets an RSA key for a connect requested by the user

### KeePass configuration

Stop already running agents:

```
[setevoy@setevoy-arch-work ~]  $ sudo killall ssh-agent
```

Start KeePass, go to the _Tools > Settings > SSH Agent_, enable it:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191203_102824.png "Linux: KeePass, SSH и хранение паролей RSA-ключей")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191203_102824.png)

Restart KeePass and see the “_ **No agent running, cannot add identity** _” error:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191202_153755.png "Linux: KeePass, SSH и хранение паролей RSA-ключей")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191202_153755.png)

It’s OK for now as we didn’t start any agent yet. There are various ways to start it during system startup, check the [Running ssh-agent with multitype terminals](https://rtfm.co.ua/en/ssh-rsa-keys-and-ssh-agent-for-ssh-keys-and-their-passwords-management/#Running_ssh-agent_with_multitype_terminals).

#### Adding an SSH key to the KeePass

Create a new item:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191202_153958.png "Linux: KeePass, SSH и хранение паролей RSA-ключей")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191202_153958.png)

In the _Password_ field specify a key’s password.

On the left side go to the _SSH Agent_, via _External File_ chose the key’s file:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191203_105013.png "Linux: KeePass, SSH и хранение паролей RSA-ключей")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191203_105013.png) 

#### `ssh-agent`

And let’s check how it will work.

Start an agent:

```
$ eval “$(ssh-agent -s)”
Agent pid 365774
```

Check variables:

```
$ env | grep SSH
SSH_AUTH_SOCK=/tmp/ssh-mR9l9Xdx9C8k/agent.1327013
SSH_AGENT_PID=1327014
```

From the same terminal, to use the `$SSH_AUTH_SOCK` variable restart KeePass:

```
$ keepassxc &
```

Check keys available in the `ssh-agent` using `ssh-add`:

```
$ ssh-add -l
4096 SHA256:WRTfqnw0TPf26r1Zx8eie2fbgxdq7fYdOKjCOtQbjbg This is comment for the Test Key (RSA)
```

Update your `~/.ssh/confg`, add authentication with RSA key:

```
Host rtfm
  Hostname rtfm.co.ua
  User setevoy
  IdentityFile /home/setevoy/.ssh/test-key
```

Ty to log in:

```
$ ssh rtfm
…
setevoy@rtfm-do-production:~$
```

_“It works!”. (c)_

#### “_Require user confirmation when this key is used_” and “_sign_and_send_pubkey: signing failed: agent refused operation_“

If you’ll also enable the “_Require user confirmation when this key is used_” option in the KeePass, during login you can face the “ **_sign_and_send_pubkey: signing failed: agent refused operation_** ” error:

```
$ ssh rtfm
sign_and_send_pubkey: signing failed: agent refused operation
setevoy@rtfm.co.ua’s password:
```

To solve it – install the `ssh-askpass` package:

```
$ sudo pacman -S x11-ssh-askpass
```

Set the `$SSH_ASKPASS` variable:

```
$ export SSH_ASKPASS=/usr/bin//usr/lib/ssh/ssh-askpass
```

And log in again:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191203_113623.png "Linux: KeePass, SSH и хранение паролей RSA-ключей")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191203_113623.png)

Still, the `openssh-askpass` won’t work in Arch Linux, see [this>>>](https://github.com/keepassxreboot/keepassxc/issues/1627) thread.

Done.

### Similar posts

- <small>12/12/2019</small> [KeePass: an MFA TOTP codes, a browser’s passwords, SSH keys passwords storage configuration and Secret Service integration](https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/) 
- <small>12/01/2019</small> [SSH: RSA keys, and ssh-agent for SSH keys and their passwords management](https://rtfm.co.ua/en/ssh-rsa-keys-and-ssh-agent-for-ssh-keys-and-their-passwords-management/)  
- <small>12/07/2019</small> [What is: Linux keyring, gnome-keyring, Secret Service, and D-Bus](https://rtfm.co.ua/en/what-is-linux-keyring-gnome-keyring-secret-service-and-d-bus/)