SSH agent & agent forwarding
Sign in with keys held by ssh-agent, 1Password or Bitwarden, and forward the agent to a host.
SSH agent & agent forwarding
Sign in with keys that never leave an SSH agent, such as ssh-agent, 1Password, Bitwarden or gpg-agent. Kubexer Terminal never holds the key; the agent signs for it. You can also forward your agent to a server, so git or ssh there can use your keys.
Use an agent to sign in
On a host's Credentials (inline) or on an identity's Authentication, choose SSH agent, then pick the agent:
| Agent | Notes |
|---|---|
| System agent | The agent your terminal uses: ssh-agent via SSH_AUTH_SOCK, or the OpenSSH Authentication Agent service on Windows. Add keys with ssh-add. |
| 1Password | Keys stay in 1Password, which asks you to approve each use. Turn on Settings › Developer › Use the SSH agent in 1Password. |
| Bitwarden | Keys stay in Bitwarden, which asks you to approve each use. Turn on Settings › Enable SSH agent in the Bitwarden desktop app. |
| Custom socket | Any agent socket, for example gpg-agent, Secretive or KeePassXC, or a Windows named pipe. ~ means your home folder on each computer. |
An agent that isn't running on this computer is marked not found on this computer. Connecting fails until it's running.
Click Show keys to list the keys the agent holds. An empty list means the agent is running but has no keys: add one with ssh-add or in the password manager.
The agent works everywhere a host is reached: terminals, SFTP, port forwards and every hop of a jump chain.
Forward your agent to a host
On the host form, turn on SSH agent forwarding → Forward SSH agent. On that server, git pull or ssh other-host can then use the keys in your agent here, like ssh -A. The agent forwarded is the one the host signs in with, or otherwise your system agent.
This works alongside password or key sign-in, so the host's own authentication doesn't change.
Only forward to servers you trust. While you're connected, anyone with root on that server can use your agent to sign in to other machines as you. The key itself never leaves your agent. Jump hosts on the way don't get the agent.
Limits
- FIDO2 security keys (
sk-ssh-ed25519,sk-ecdsa) and certificates held in an agent are listed with a not usable yet badge. The agent can sign with them, but Kubexer Terminal can't offer them to a server yet, so they're skipped. Use a regular key in the agent, or a Private key / Certificate identity. - Share an identity isn't available for agent identities, because Kubexer holds no key to share. Share it from the agent instead.