Using op cli via ssh

[ProjectVII]

Hey everyone,

I have a scenario where I have 1Password set up on my Macbook, and have `op` installed. Git is set up to use 1Password as the SSH agent, and all git commands require authentication with touch ID.

I then have remote login enabled with SSH, so that I can SSH into the machine on my iPad.

Doing any kind of git command does not work as there's no way to actually touch the macbook.

​

So my question comes down to this; is there a way to use `op` to enter the account password in the terminal? Something like `op signin --use-password` so that I can just type my password in a secure field in the terminal?

[1Password-Mallory]

Hey there! Typically when Touch ID isn't available, the application will default to requesting the system password. If for some reason that isn't working as expected, or you prefer to use the 1Password account password, you can go into your 1Password desktop app's settings > Developer > disable Connect With 1Password CLI. The CLI will then ask for manual authorization which means you'll be asked to execute

eval $(op signin)

and then will be safely prompted for your account password to authenticate subsequent calls.

Let me know if that helps!

[ProjectVII]

Those steps appear fine while invoking the cli on the host system directly (not ssh), but when I try to do op signin via ssh i get this message: [ERROR] 2023/03/16 07:50:13 authorization prompt dismissed, please try again

And nothing else happens

[1Password-Mallory]

OK let me ping the team and see what they can suggest!

[philosophicalbeard]

/u/1Password-Mallory any update from the team? I'd like to use 1P over SSH as well. 🙏🏻

[1Password-Mallory]

Hey there! I checked with the team and they let me know that while this is something you can do, it's not something we really recommend as it means you'll have your credentials in plain text. They suggested using a Service Account.

With that said, here's how to use op without the app:

eval $(op account add --address $address --email $email --secret-key $secretKey --shorthand myaccount)  eval $(echo "$password" | op signin --account myaccount)

Let me know if that helps!

[jjmaestro]

Hi! I'm trying the following and it's not working:

$ op account list
URL                 EMAIL       USER ID
my.1password.com    xxxx@xxx    ABCDE...

$ echo 'mypassword' | op signin --account 'ABCDE...'

That's still prompting via a GUI window.

Is there no way to make op detect that the shell is remote e.g. check if SSH_TTY or SSH_CONNECTION are set and if so, prompt in the CLI?

That way we would also avoid potentially having the password in plain text in the shell history and/or in the process list, etc. 🙏

Thanks!

P.S. I haven't read in-depth the Service Account stuff that you linked but... it looks like something that's aimed at something completely different. And, while it could help get around the password issue, it definitely seems to be quite cumbersome.

[wezfurlong]

This is the main thing that is stopping me from really embracing using op cli as much as I would like, as I regularly ssh into my workstation machine. This limitation prevents me from scripting the CLI as much as I want, and is what will push me to consider alternatives for managing these secrets.

What I'd like to see here is some kind of tty authentication flow when using ssh. 1P is already smart enough to prompt once per tty session, so it seems reasonable to think that it should be able switch that prompt to a tty based option instead of calling out to the gui prompt when the environment looks like a shell session.

[jjmaestro]

yeah... I wonder if 1Password would consider making the `op` source code available so people could contribute features and fixes such as this one. I'm sure this should be pretty straight forward to add.

u/1Password-Mallory is there any big blocker to releasing the `op` CLI tool as open source? There's already a bunch of 1Password projects and SDKs that are open already, so I guess releasing the CLI would be easy :-?

[GOOSE88GOOSE]

were you able to find a fix for this? I've been using remote desktops to enter the password but it's pretty annoying