New plugin: ssh (password) authentication

[budde25]

Platform or tool

ssh

Relevant links

• https://www.openssh.com
• https://www.man7.org/linux/man-pages/man1/ssh.1.html

Goal or desired behavior

Authenticate by autofilling password stored in 1password for ssh host.
This would be very useful for instance where key authentication is not possible.

Contribution

• I'd be up for building the plugin myself.

Additional information

No response

[vinit-chauhan]

Hey @budde25 - I don't see any way to provide a password along with the ssh command. However, I am wondering if it would be okay to use sshpass utility and build the plugin around it for ssh password support.

[budde25]

yes sshpass to pass the password would make sense to me for passing it from the command line. The only other way I know programmatically get it in is to use the SSH_ASKPASS environment variable. Which might be nice too cause it wouldn't require an external tool (sshpass being particularly annoying to get on mac due to being removed from homebrew).

https://github.com/Homebrew/brew/blob/5c3ec3e7cac1e0bccb2e74b0af70f2fcfa48eb43/Library/Homebrew/missing_formula.rb#L49-L52

My current setup does just have SSH_ASKPASS point to a sh script to grab my password from the op tool.

https://www.man7.org/linux/man-pages/man1/ssh.1.html:

SSH_ASKPASS
If needs a passphrase, it will read the
passphrase from the current terminal if it
was run from a terminal. If does not have
a terminal associated with it but DISPLAY
and SSH_ASKPASS are set, it will execute
the program specified by SSH_ASKPASS and
open an X11 window to read the passphrase.
This is particularly useful when calling
from a .xsession or related script. (Note
that on some machines it may be necessary
to redirect the input from /dev/null to
make this work.)

SSH_ASKPASS_REQUIRE
Allows further control over the use of an
askpass program. If this variable is set
to “never” then will never attempt to use
one. If it is set to “prefer”, then will
prefer to use the askpass program instead
of the TTY when requesting passwords.
Finally, if the variable is set to “force”,
then the askpass program will be used for
all passphrase input regardless of whether
DISPLAY is set.

[vinit-chauhan]

Hey @budde25 - Yeah I thought the same, It's always troublesome when we have third-party dependencies.

But for new Linux users, it is the easiest way for them to get started.
With that being said, For MAC ( as you suggested) and for Windows this utility is not available. Therefore, we will have to think of some generic solution. I'll surely look into the Env variable you sent.

If anyone knows some generic solution for passing passwords, feel free to chime in. 😄

[mrjones2014]

There's also a built-in SSH agent in the desktop app, in case you weren't aware: https://developer.1password.com/docs/ssh/agent/