Files
hermes-skills/security/security-tools/references/ssh-key-vault-storage.md
T

58 lines
2.0 KiB
Markdown

# SSH Key Storage in 1Password — Reference
## Session: 2026-06-26 (Hermes Agent)
### Problem
1Password's native "SSH Key" item category (`category: SSH_KEY`, field type `SSHKEY`) does **not** correctly persist the `private_key` field when created via `op item create`. The field is silently dropped from the created item.
### Workaround
Use `SECURE_NOTE` with a `CONCEALED` field labeled `private key`. This stores the key securely, hides it from casual view, and makes it retrievable via `op read` or `op item get --reveal`.
### Pattern
1. **Generate key locally** (Ed25519 preferred):
```bash
ssh-keygen -t ed25519 -C "hermes-agent@proxmox" -f ~/.ssh/id_ed25519_proxmox -N ""
```
2. **Build JSON template from file** (never pass private key on CLI):
```bash
python3 -c "
import json
pk = open('~/.ssh/id_ed25519_proxmox').read().strip()
puk = open('~/.ssh/id_ed25519_proxmox.pub').read().strip()
template = {
'title': 'hermes-agent Proxmox SSH Key',
'category': 'SECURE_NOTE',
'fields': [
{'id': 'notesPlain', 'type': 'STRING', 'purpose': 'NOTES',
'label': 'notesPlain', 'value': f'Public key:\\n{puk}'},
{'id': 'private_key', 'type': 'CONCEALED',
'label': 'private key', 'value': pk}
]
}
json.dump(template, open('/tmp/op_template.json', 'w'))
"
```
3. **Create and verify**:
```bash
cat /tmp/op_template.json | op item create - --vault Hermes
# Verify
op item get "hermes-agent Proxmox SSH Key" --vault Hermes --reveal
```
### Retrieval in Scripts
```bash
pk=$(op read 'op://Hermes/hermes-agent Proxmox SSH Key/private key')
tmpkey=$(mktemp)
echo "$pk" > "$tmpkey"
chmod 600 "$tmpkey"
ssh -i "$tmpkey" root@10.0.20.91 "hostname"
rm -f "$tmpkey"
```
### Note on Service Accounts
Hermes' `OP_SERVICE_ACCOUNT_TOKEN` is scoped to specific vaults. If `op vault list` shows only "Hermes", that's the only vault accessible. To add access to other vaults, update the 1Password integration's vault grants in the 1Password admin console.