![KeePassXC Logo](/assets/images/blog/2023/02/18/00-cover.png)

I've been using KeePassXC to manage passwords for a number of years now. It's simple, secure and open-source! It works 
offline, it's cross-platform, so it works across my different devices and operating systems and it's rich in features. 

I don't actually even use all the features, for example I don't use any of the browser integration features. Personally 
I just don't feel comfortable giving browsers that level of access to my password manager, I'd rather copy+paste the 
passwords myself each time. But that's just me, if you aren't quite as paranoid as me then you might appreciate these 
features.

In my line of work I have to manage many different [SSH Keys](https://www.ssh.com/academy/ssh-keys) (Secure Shell) and 
as per best practice I protect each of these keys with a password which I have been storing safely in KeePassXC. Much 
like how I manage my normal passwords I have been copying the password for each key from KeePassXC and then pasting into 
my terminal when adding the key to [SSH Agent](https://www.ssh.com/academy/ssh/agent).  

Today I decided to finally have a look into the `SSH Agent Integration` features built into KeePassXC and man do I wish I 
had done this sooner! By enabling the SSH Agent Integration features we can configure KeePassXC to automatically add our
SSH key(s) to the SSH Agent whenever the KeePassXC database is opened, and we can have it automatically remove the key(s)
again when the database is closed or locked. No more cutting and pasting passwords or leaving key(s) exposed.

Keep reading to see how this works.

## Step 1: Create an SSH Key.

Create an SSH Key using the `ssh-keygen` command. Example: 

```bash
ssh-keygen -t ed25519 -C "keepassxc.ssh-agent.demo@liam-reilly.info"
```

This command will generate a set of key files (public and private) and will ask you where to store them. The default will
be a hidden `.ssh` folder inside your users `~/` (home) directory. You will also be given the opportunity to protect the key
with a password which must be entered when attempting to use the key, or when adding the key to the `ssh-agent`.

For this example I named my key: `id_ed25519.demo`. I wrote my key to the directory: `/Users/liam/Desktop/demo/ssh`.
I used the internets favourite password: `correct horse battery staple`. 

[If this password seems strange to you please read this](https://xkcd.com/936/).

I now have the following private and public key files:

```bash
id_ed25519.demo
id_ed25519.demo.pub
```

## Step 2: Enable the SSH Agent Integration in KeePassXC 

In KeePassXC option the Preferences page and find the SSH Agent tab. Tick the option `Enable SSH Agent Integration` and 
click `OK`.

![enable ssh agent](/assets/images/blog/2023/02/18/01-enable-agent.png)

## Step 3: Add a record to KeePassXC database for your SSH Key.

The `Password` field is the important field here and this should match the password you used to protect your SSH key. 
In this example `correct horse battery staple`.

Feel free to enter any other detail you find useful such as a `title` or `username`. Here I just matched to those found
inside the key.

![add record](/assets/images/blog/2023/02/18/02-new-record.png)

## Step 4: Enable SSH Agent for this record. 

This is where we link the KeePassXC record to the SSH Key we generated above. Enter the path to the private key you 
generated earlier. 

In my case: `/Users/liam/Desktop/demo/ssh/id/id_ed25519.demo`

If you enter the path correctly should see some information about the key displayed (`fingerprint`, `comment`,`public 
key`).

You will notice I have also ticked the 2 check boxes at the top of the screen. 

`Add key to agent when database is opened/unlocked`

`Remove key from agent when database is closed/locked`

If you would rather not have this behaviour leave them unticked. You can add/remove keys manually. I will show this next.

![enable ssh](/assets/images/blog/2023/02/18/03-enable-ssh.png)

Once you are happy click `OK` and you are done!

## Step 5: Add SSH key to SSH Agent

If you ticked the option above to add your key automatically when the database is opened and unlocked then you can simply
close KeePassXC and re-open and you should find your key is now loaded into `ssh-agent`. If you did not choose to have
this automatic integration simply right-click the record in KeePassXC and click the option `Add key to SSH Agent`

![manual-add](/assets/images/blog/2023/02/18/04-manual-add.png)

Now using the terminal enter the command `ssh-add -L` and you should see your key.

## Step 6: Remove SSH key from SSH Agent

If you ticked the option above to remove your key automatically when the database is closed/locked then you can simply 
close KeePassXC and run the command `ssh-add -L` again and you should see your key is no longer loaded.

Alternatively to remove the key manually right-click the record in KeePassXC and click the option 
`Remove key from SSH Agent`.

![manual-remove](/assets/images/blog/2023/02/18/05-manual-remove.png)

---
I wish I had bothered to learn this sooner. This is such a great bit of functionality. A real win-win. It's easier for 
us as we no longer have to think about manually managing SSH Keys day to day, and it's so much better from a security 
perspective. If you take advantage of the automatic adding/removing of keys when the database is locked/unlocked then 
no longer are SSH keys exposed by simply being left in the SSH Agent. They are removed from the agent and we have to 
make a conscious effort to unlock our database before the SSH keys can be used again. 

Remember this is just another additional layer of security which can be combined with other KeePassXC security features 
such as `Key Files` and/or `Hardware Keys` such as Yubikey.

I hope others can find this useful and have the same "OMG why didn't I do this sooner?" moment that I had today!

KEEPASSXC - SSH AGENT

Did you enjoy this post?️

You Might Also Like

Beyond Order

Auto Generate RSS