SSH Keys

[larena1]

bitwarden/server#4575

As this will be merged soon, is it planned to add support for SSH Keys to Vaultwarden as well?

@dani-garcia @BlackDex

[BlackDex]

Looks simple enough as far as i can tell. But i have not validated it yet.

[larena1]

It has been merged into main now so maybe you could take a look?

[BlackDex]

The main other issue is the web-vault. There is no support yet for newer versions then 2024.6.2 in Vaultwarden yet. And it requires a specific version number to be used on the server side for it to work.

[larena1]

Do newer web versions require some new endpoints or why is that exactly?

[BlackDex]

The manager role has disappeared.
I'm working on a quick fix to use the custom role and have it backwards compatible in the database instead of migrating everything back and forward which will b cause issues somewhere in the end.

[larena1]

It seems you are more or less maintaining Vaultwarden alone at this point and @dani-garcia has stopped contributing. Would be a shame if Vaultwarden was abandoned but it feels a bit like it already.

[larena1]

The feature has now also been added to the clients. Do you know if there's more to do to support the most recent client versions than just the manager role? Otherwise at some point it could also happen that Vaultwarden cannot be used at all anymore with up to date clients when it's already behind 6 months now, right?

[BlackDex]

Since we use Vaultwarden our self, we would of course thrive to get these features in.
There are probably some more features added or changed on how the web-vault works, and maybe some clients.

Those are not yet tested by me at least.

[dani-garcia]

This has been implemented today with #5187. It's usable only on desktop clients built from source now as long as you update the version and enable the required feature flags on the server.

The official release of the clients will be next month, if everything goes according to plan.

[davidyannick86]

the desktop app is up to date but can't. see any option to add an ssh key I'm on mac nor on vaultwarden server or bitclient desktop

[BlackDex]

Have you added the options?

vaultwarden/.env.template

Lines 353 to 355 in fd51230

	## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
	## - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
	# EXPERIMENTAL_CLIENT_FEATURE_FLAGS=fido2-vault-credentials

[davidyannick86]

Have you added the options?

vaultwarden/.env.template

Lines 353 to 355 in fd51230

	## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
	## - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
	# EXPERIMENTAL_CLIENT_FEATURE_FLAGS=fido2-vault-credentials

yes I did it

[BlackDex]

It works for me on Linux.
If I'm correct this feature doesn't work on all platforms, but not sure.

I at least see it works fine on Linux with the AppImage.

[quexten]

There is a bug in 2024.12.0 introduced by a last-minute security fix, that breaks the agent on Linux/Mac: bitwarden/clients#12356
For this reason it looks like ssh-keys will be delayed until the january release.

That said, the list of currently unsupported platforms/protocols:

• Snap
• Flatpak
• Windows Pageant (Putty/Filezilla)
• Windows Subsystem for Linux

All other platforms are expected to work.

[Faabvk]

Ah man I thought I was going crazy trying to figure out why it wasn't working for me.
From Admin > Diagnostics > Support string:

  "experimental_client_feature_flags": "fido2-vault-credentials,ssh-key-vault-item,ssh-agent",

And from my client

Version 2024.12.0
SDK 'main (edee180)'
Shell 32.1.1
Renderer 128.0.6613.137
Node 20.17.0
Architecture x64

[WRW001]

Hello! I have my desktop client updated to 2024.12.0, and I also have the EXPERIMENTAL_CLIENT_FEATURE_FLAGS configured. And I can use it generate new ssh-keys. But I am having issues with the key algorithm, the only algorithm supported is ed25519, it seems that there is no chance generate a RSA key or an ECDSA key, and also there is no chance to import any RSA/ECDSA key. Any solutions?

[WRW001]

@quexten

That said, is there a good use-case you have for RSA/EcDSA?

RFC 6187
X.509 Certificates can be used for both client and server authentication. This is the scenario in which RSA and ECDSA have widely been used.

[rushout912]

and also there is no chance to import any RSA/ECDSA key. Any solutions?

RSA keys are supported for import. However, some client (for instance putty) generate non-standard encodings (f.e using a 64 linewidth instead of 70), which needs an upstream dependency to be supported. Importing keys generated from openssh works though - even password protected ones.

@WRW001 which client did you generate/export your keys in?

That said, is there a good use-case you have for RSA/EcDSA? Both are cryptographically sub-par, compared to ed25519, and have both a higher risk of implementation vulnerability. For instance, the rsa crate, used in the ssh-agent, has unresolved timing sidechannels: RustCrypto/RSA#394 which could allow forging ssh signatures when you connect to a malicious server. That is to say, where possible, ed25519 should be used. I understand there is some legacy systems and embedded systems that do not yet support ed25519, so RSA is the alternative, discouraged, but still supported key type. I'm looking to hear about good use-cases though, because these strengthen the case for adding RSA to the generator instead of just allowing import.

Sorry for bumping into discussion, is password encrypted ssh key import supported in current client versions (2024.12.0)? When I tried to import such keys, client asked me to enter the password for the SSH key, I typed the password, and then client said the SSH key is invalid. I checked the key's linewidth and I'm sure it has 70 linewidth, which is OpenSSH format.

[WRW001]

@rushout912 Are you using the ECDSA key? It is currently totally unsupported. A 70-linewidth RSA or ED25519 key seems OK.

[quexten]

Sorry for bumping into discussion, is password encrypted ssh key import supported in current client versions (2024.12.0)? When I tried to import such keys, client asked me to enter the password for the SSH key, I typed the password, and then client said the SSH key is invalid. I checked the key's linewidth and I'm sure it has 70 linewidth, which is OpenSSH format.

I'd also recommend creating a GitHub issue on the upstream bitwarden/clients. It would especially be helpful to have test keys, or the application they are generated in.

[WRW001]

@quexten A new issue has been filed on the upstream bitwarden/clients.
bitwarden/clients#12412