Vaultwarden SSH Agent Script

A PowerShell script that automatically loads SSH keys from your Vaultwarden vault into your SSH agent. This script provides a secure way to manage and load your SSH keys by storing them in your Vaultwarden vault and loading them into your SSH agent when needed.

Prerequisites

• PowerShell 5.1 or later
• Bitwarden CLI installed and available in PATH
• OpenSSH installed on your system
• SSH agent running on your system
• A Vaultwarden (self-hosted Bitwarden) instance

Installation

Download the script file (vaultwarden-ssh-agent.ps1) to your preferred location

Configuration

Initial Setup

• Create a folder (default name: 'ssh-agent') in your Vaultwarden vault
• Create a new SSH Key item in the folder by selecting "SSH Key" as the type
• An ED25519 key pair will be automatically generated
  • If you need different keys, you can use the refresh button to generate a new pair
  • Note: The key generation is managed by Bitwarden Client and cannot be edited manually
• Save the item
• Deploy the generated public key to systems where you need access

Usage

Basic usage

.\vaultwarden-ssh-agent.ps1

Run with debug information

.\vaultwarden-ssh-agent.ps1 -Debug

Use a custom folder name

.\vaultwarden-ssh-agent.ps1 -FolderName "my-ssh-keys"

Security Features

• Secure session key storage using Windows Credential Manager
• Secure handling of private keys using SecureString
• Proper cleanup of sensitive data from memory
• Key format validation before loading

Clearing Stored Session Token

The script stores the Bitwarden session token in the Windows Credential Manager. This allows the script to reuse the session, avoiding the need to unlock the vault on every run.

If you need to clear the stored session for any reason, you can run the following command: .\Vaultwarden_ssh-agent.ps1 -ClearSession

This will remove the stored session token from the Windows Credential Manager. The next time you run the script, it will need to unlock the vault with your master password before proceeding.

Clearing the stored session may be necessary to ensure a fresh session is obtained.

Error Handling

The script includes comprehensive error handling:

• Prerequisites validation
• Vaultwarden configuration verification
• Key format validation
• Detailed debug output when needed
• Operation results reporting
• Troubleshooting

Common Issues

"SSH agent is not running"

Start the SSH agent service:

Set-Service ssh-agent -StartupType Automatic
Start-Service ssh-agent

"Folder not found"

• Create the folder in your Vaultwarden vault
• Verify the folder name matches the script parameter (default: "ssh-agent")

"Failed to add key"

• Verify the SSH agent is running
• Check entries in the created folder in your Vaultwarden vault
• Run with -Debug flag for more information

"Bitwarden CLI not found"

• Ensure Bitwarden CLI is installed
• Verify bw is in your system PATH
• Debug ModeRun the script with the -Debug switch for detailed operation information:.\vaultwarden-ssh-agent.ps1 -Debug

Security Notes

• Never share your private keys
• Regularly rotate your SSH keys
• Session key are stored securely in Windows Credential Manager
• Private keys are handled as SecureString during processing
• All sensitive data is cleared from memory after use
• Monitor SSH agent contents with ssh-add -l

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

Support

If you encounter any issues or have questions, please open an issue in the repository.

License

This script is available under the MIT License. See the LICENSE file for more details.