[macOS] SSH-Agent unlock with TouchID from Terminal

[mietzen]

Hi
I'm not sure if this the mandela effect at work, but I'm somewhat sure I had KeePassXC on MacOS setup so that if the DB was locked and I opened a Terminal I got a TouchID popup to unlock, like using the browser. (Or like using Strongbox)

I switched the password manager a long time ago and now switched backed to KeePassXC, but I can't get it to work nor can I find anything about this. Am I just misremembering this?

[droidmonkey]

TouchID unlock prompt would happen with global auto-type request and browser integration request. Otherwise only when you focus the keepassxc main window.

[mietzen]

Then I probably misremembered, never the less I‘ll try to script something to make it happen.

[mietzen]

KeePassXC SSH Agent

I create a Python package, checkout:

https://github.com/mietzen/keepassxc-ssh-agent?tab=readme-ov-file#keepassxc-ssh-agent

---

Old Answer

I used claude code to digg through the KeePassXC code and create this prototype:

https://github.com/mietzen/keepassxc-ssh-agent

---

This is what the workflow looks like:

We first need to associates our tool with KeePassXC, like any browser would do (one time):

$ keepassxc-ssh-agent setup   

KeePassXC SSH Agent - Setup
========================================

Prerequisites:
  1. KeePassXC must be running
  2. Browser integration must be enabled in KeePassXC settings

Connecting to KeePassXC...
Requesting association with KeePassXC...
Please approve the association in the KeePassXC window.
16:52:50 [INFO] keepassxc_ssh_agent.browser_client: Associated with KeePassXC (id=KeePassSSH)
Association successful! ID: KeePassSSH

Setup complete! To use the agent:

  1. Start the agent:
     keepassxc-ssh-agent run --socket /Users/nils/.keepassxc/agent.sock

  2. Add to your ~/.ssh/config:
     Host *
         IdentityAgent "/Users/nils/.keepassxc/agent.sock"

  3. (Optional) Add a LaunchAgent for auto-start

Then we can start the agent:

$ keepassxc-ssh-agent run   
16:57:28 [INFO] keepassxc_ssh_agent.server: SSH agent proxy listening on /Users/user/.keepassxc/agent.sock
16:57:28 [INFO] keepassxc_ssh_agent.server: Forwarding to system agent at /private/tmp/com.apple.launchd.abcdefgh/Listeners

And Test it in another terminal:

$ SSH_AUTH_SOCK=~/.keepassxc/agent.sock ssh-add -l
256 SHA256:AZKD...65 user@id_ed25519 (ED25519)

You should get a unlock request (TouchID) and output similar to this from the the agent:

16:57:33 [INFO] keepassxc_ssh_agent.server: Triggering KeePassXC database unlock...
16:57:33 [INFO] keepassxc_ssh_agent.browser_client: Unlock dialog triggered, waiting for user to authenticate...
16:57:37 [INFO] keepassxc_ssh_agent.browser_client: Database unlocked successfully
16:57:37 [INFO] keepassxc_ssh_agent.server: Database unlocked, keys should now be available

---

To make this actually practical usable we could do something similar like this:

cat << EOF > ~/Library/LaunchAgents/com.strongbox.SSH_AUTH_SOCK.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "[http://www.apple.com/DTDs/PropertyList-1.0.dtd](http://www.apple.com/DTDs/PropertyList-1.0.dtd)">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.strongbox.SSH_AUTH_SOCK</string>
  <key>ProgramArguments</key>
  <array>
    <string>/bin/sh</string>
    <string>-c</string>
    <string>/bin/ln -sf $HOME/.strongbox/agent.sock \$SSH_AUTH_SOCK</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
</dict>
</plist>
EOF
launchctl load -w ~/Library/LaunchAgents/com.strongbox.SSH_AUTH_SOCK.plist

Source: https://strongbox.reamaze.com/kb/ssh-agent/ssh-agent

But point to our keepassxc socket, so this should globally work with all apps like VSCode, git, etc.

I still need to review some of the Code Claude created and write docs, test, CI and finally publish the package on pypi. I will try doing so tomorrow or on the weekend. But this basically does all I need. This might work on linux as well.

[mietzen]

@droidmonkey this is macOS only, I guess some work would be needed to make this cross platform compatible, but feel free to copy or reference this if you like.

[navrocky]

@mietzen I'll try to port it to Linux