wkoszek / lastpass-ssh

SSH key management with LastPass

SSH key management with LastPass

This repository has a tool called lastpass-ssh which integrates LastPass with SSH. You store your SSH key passphrases in LastPass, and SSH key files somewhere else. To start using SSH, you type lastpass-ssh and it will unlock all SSH keys with appropriate passphrases taken from LastPass.

How to install

Install the LastPass command line client (lpass) from a lastpass-cli package and lastpass-ssh Gem:

brew install lastpass-cli
gem install lastpass-ssh

Setup

You make yourself an "SSH" subfolder in the LastPass' "Secure Notes" and add secure notes there. Each note has a name and a passphrase. The name corresponds to the filename of the SSH key file, and the passphrase is its key's passphrase.

Example: if you have a key like myrepos in ~/.ssh/, then the name of the Secure Note would be myrepos.

How to use

Run:

lastpass-ssh

It will poll the "Secure Notes/SSH" folder and for each note of name "A", it'll try to perform ssh-add ~/.ssh/A with an appropriate passphrase.

You can change the location of keys by passing --keys-path=<where-you-have-keys>. By default all keys are added. You can change this behavior by passing --key=KEYNAME option, where KEYNAME is the name of the key file you want to add.

Learn more

I wrote an article on lastpass-ssh.

Details

Internally the lastpass-ssh script is based on the lpass command line tool provided by LastPass team themselves.

Author

• Wojciech Adam Koszek, [email protected]
• http://www.koszek.com

lastpass-ssh's Issues

Script tries adding non-existent key

Thanks for this script - works great.

I notice that when running lastpass-ssh that it tries adding a key that doesn't exist before successfully loading the keys found in Secure Notes/SSH:

LastPass key ID  name id /Users/dan/.ssh/id: No such file or directory
LastPass key ID XXXXXXXXXXXXXXXXXXX name id_rsa Identity added: /Users/dan/.ssh/id_rsa (/Users/dan/.ssh/id_rsa)

I only have a single key in Secure Notes/SSH, and that is id_rsa. This is on macOS Sierra 10.12.5.

Changed Password variable name to avoid PWD environment collision

Consider modifying the name of the password variable from PWD to PASS or something similiar. This naming may cause unexpected collision with the environment variable of PWD.

lastpass-ssh does not fetch ssh keys

I tried using this with my lastpass account but couldn't get it to work. I have LastPass CLI v1.1.2 and have it setup with 2 factor authentication. Was wondering if there's something I'm missing to get it to work?

I did the following:

1. Manually added my ssh key to lastpass.
   name: id_rsa
   folder: SSH
   note type: SSH Key
2. ran "lpass --login [email protected]" on command line to login to my lastpass acccount

*Note- I can view my account info with "lpass ls" and "lpass show" commands.
from "lpass show id_rsa":

Date: ,,
Hostname: my-Folio-9470m
Public Key: $MY_PUBLIC_KEY
DEK-Info:  AES-128-CBC,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Proc-Type:  4,ENCRYPTED
Private Key: $MY_PRIVATE_KEY
Passphrase: 
Format: AES
Bit Strength: 128
NoteType: SSH Key
Notes: My Key

3. ran "lastpass-ssh --keys-path ~/.sshtest" to fetch ssh key

No keys are aded to ~/.sshtest folder

undefined method `each' for nil:NilClass (NoMethodError)

I am unable to run lastpass-ssh. Is there a specific ruby version this is required to run with?

$ lastpass-ssh

Traceback (most recent call last):
	2: from /usr/local/bin/lastpass-ssh:23:in `<main>'
	1: from /usr/local/bin/lastpass-ssh:23:in `load'
/usr/local/lib/ruby/gems/2.5.0/gems/lastpass-ssh-1.0.4/bin/lastpass-ssh:65:in `<top (required)>': undefined method `each' for nil:NilClass (NoMethodError)

"secure notes" maybe changed?

I think lastpass maybe has updated since you've published this because "Secure Notes" appear as "Notes". I'm not sure if it was always this way or not, but regardless, creating a folder called "Secure Notes" in the notes section, and a subfolder of "SSH" does not work. Nor does creating a folder of "SSH" at the root of the notes level. Please let me know if I'm not understanding correctly.

It should check lpass in $PATH

Currently lastpass-ssh script only checks /usr/bin and /usr/local/bin for lpass command, it should check $PATH instead.

Use Printf to automatically escape password string

Use printf to escape the password string, this would resolve the possible scenario where a password contains unescape double quotes. I've modified my code to the following:

printf -v PWD "%q" "$(lpass show --field=Passphrase ssh/$(basename ${KEY_NAME}))"

This way the PWD variable automatically escapes special characters.