/
Make an SSH key in 1Password

Make an SSH key in 1Password

Use this key to log in to the lab servers securely without having to type your password in every time. These are like passkeys where you have a key pair (one private key that you keep, and one public key that goes on the server). See Make an SSH key for the lab servers for how to send it and test it.

First you need a UT 1Password account and the 1Password desktop app. See 1Password.

Keep the key in your own 1Password account. Faculty and staff use their Enterprise account, because the key is for UT work. Students use their personal account. Never put an SSH key in a shared vault: everyone with access to the vault could then log in as you.

1. Make the key

  1. Open and unlock the 1Password app.

  2. Go to your own vault (Personal, Private or Employee).

  3. Select New Item, then SSH Key.

    1Password New Item picker with SSH Key selected

  4. Select Add Private Key, then Generate New Key.

  5. Choose Ed25519, then select Generate and Save.

    Generate New Key dialog with Ed25519 selected

  6. Name the item, for example KH Lab servers.

2. Turn on the SSH agent

The SSH agent lets the ssh command use the key in 1Password.

macOS: Go to 1Password > Settings > Developer. Under SSH Agent, select Set up the SSH Agent and follow the steps. (Older versions show a Use the SSH Agent checkbox instead.)

1Password for Mac, Settings, Developer, with the Set up the SSH Agent button

Then in Settings > General, select Keep 1Password in the menu bar and Start at login.

1Password for Mac, Settings, General

Windows: Go to Settings > Developer. Under SSH Agent, select Set up the SSH Agent and follow the steps.

1Password for Windows, Settings, Developer, with the Set up the SSH Agent button

Then in Settings > General, select Keep 1Password in the notification area and Open 1Password on startup.

1Password for Windows, Settings, General

Linux: Go to Settings > Developer. Under SSH Agent, select Set up the SSH Agent (or the Use the SSH Agent checkbox) and follow the steps. In Settings > General, select Keep 1Password in the system tray.

3. Tell ssh to use 1Password

If you already use SSH: these lines send every SSH connection through 1Password. On macOS or Linux, copy ~/.ssh/config to ~/.ssh/config.backup first. If the file already has IdentityAgent or IdentityFile lines, ask Dusten before you change it. To undo, put your backup copy back.

macOS: Add these lines to the file ~/.ssh/config. Make the file if it does not exist.

Host * IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"

Linux: Add these lines to ~/.ssh/config:

Host * IdentityAgent ~/.1password/agent.sock

Windows: Open Services (services.msc). If OpenSSH Authentication Agent is in the list, stop it and set its startup type to Disabled. You do not need to change any SSH settings.

Before you disable it, write down its startup type. If you already use this service for other keys, ask Dusten first: those keys stop loading when it is disabled. To undo, set the startup type back and start the service.

Windows Services list with OpenSSH Authentication Agent set to Disabled

1Password works with the ssh, scp and sftp commands that come with Windows, and with VS Code. It does not work with PuTTY or WinSCP. If you use them, make your key with ssh-keygen instead (see Make an SSH key for the lab servers).

4. Copy the public key

Open the SSH key item and copy the public key. It is one line that starts with ssh-ed25519. Send it to Dusten as described in Make an SSH key for the lab servers.

SSH key item showing the public key field

The public key is safe to send. Never send the private key.

To test the key, and for what to do if you lose your laptop or your 1Password access, see Test your key and If you lose your laptop or your key on Make an SSH key for the lab servers.