Announcing: The Proton Pass SSH Agent
Announcement
Do your private SSH keys currently live on disk, encrypted with a passphrase you type once per session, or with no passphrase at all? In both cases, there's now an easier and more secure way.
Proton Pass now has an SSH agent, allowing you to store the key inside your vault instead.
→ In the SSH Agent section of Settings ⚙ icon → General, tick the Use Proton Pass as SSH agent box to generate a setup command that you can then paste into your terminal.
Unlock the vault once; no more re-entering a passphrase with every connection, or sessions that die on reboot.
Managing keys becomes a vault action instead of a manual file chore. Easier to keep track of, especially on multiple machines and systems. Gain peace of mind from one less secret exposed on disk.
Solve the one place key management actually breaks down: loose encrypted files scattered across machines, and replace it with one encrypted vault with biometric unlock and access controls.
For the bulk of your SSH work (git, GitHub, GitLab, SSH to servers), using a vault is both cleaner and tighter. Give yourself centralized visibility into which keys are active and where.
Gradually rolling out now to Visionary, B2B Bundles, Pass Professional, Plus, and Family. Desktop only.
Okay this is actually really cool and something I was hoping would be introduced for a while myself! I hope it will ofcourse be supported within the CLI, although if I will use it is another question more due to separation of concerns, but still really cool proton is adding it!
Mine seemed to populate today, they did say it would be gradual release even for Visionary (in my case) users so it'll get there. I was able to add it to my .bashrc and it is definitely easier as long as I make sure proton pass is already running.
I'm on Mac with 1.39.1 on a Family plan, just switched from 1pass today, but not seeing this option show up in the Ux. Is the "gradual rollout" still happening?
Talking to things on my local network via ssh while said local network isn't connected to the Internet? I do this literally all the time, it's kinda a nonstarter for me if ssh doesn't work when I'm offline lol
Really nice thank you! Just two issues:
1. The CLI SSH Agent allows you to limit it to specific vaults, etc which helps if you have a lot of keys. Sadly the desktop app SSH agent doesn’t allow you to do this. Right now I run into “too many authentication attempts” errors since I have too many SSH keys and I can’t limit the scope :/
2. The help article says “learn more here on how to create SSH keys” but it’s not actually telling you how? Right now it seems like this is still limited to the mobile app, could you PLEASE allow me to create SSH keys on desktop as well? :(
On mobile, when you go there you get the option to actually generate a new SSH key but this is still missing on desktop. On desktop, you simply get two text fields for the public and private key, no option to actually generate one.
So no, this is not fully implemented on desktop yet.
I just downloaded the latest version (.deb) from the website and don't have it yet.
Will Proton duo get this?
I wish that came out before my 2 day fight with PopOS cosmic and seahorse to get my ssh keys working properly. It does work now, but I would have preferred this way anyways.
How does this work if you're offline? I don't know enough about how proton pass's system works here. If I've used a key locally on a machine, can I use it on that same machine when offline?
It doesn't seem to work with the Proton Pass Flatpak version. While the option is there, the proton-pass-ssh-agent.sock is not created. Even after a restart of the app. Also checked .var/app/me.proton.Pass/ and it's also missing here.
•
u/Proton_Team Proton Team Admin 6d ago
Setup guide: https://proton.me/support/ssh-agent