Proton Pass CLI — SSH Keys Setup

use-proton-pass-ssh-agent.md

Proton Pass CLI — SSH Keys Setup

1. Installing pass-cli

Check the official documentation for the latest version: https://protonpass.github.io/pass-cli/get-started/installation/

# Verify installation
pass-cli --version

# Log in
pass-cli login

---

2. Importing existing SSH keys

Nominal case — key in modern OpenSSH format

The key header should show -----BEGIN OPENSSH PRIVATE KEY-----:

head -1 ~/.ssh/id_ed25519

Direct import:

pass-cli item create ssh-key import \
  --from-private-key ~/.ssh/id_ed25519 \
  --vault-name "SSH Keys" \
  --title "my-ed25519-key" \
  --password
# (enter passphrase when prompted)

---

Problematic case — RSA key in PKCS#1 format (legacy format)

The header shows -----BEGIN RSA PRIVATE KEY----- with Proc-Type: 4,ENCRYPTED. pass-cli returns the error: Failed to parse SSH private key / PEM Base64 error: invalid Base64 encoding

Solution: decrypt via openssl before importing, then clean up

# 1. Temporary copy
cp ~/.ssh/id_rsa /tmp/id_rsa_temp

# 2. Decrypt (enter current passphrase when prompted)
openssl rsa -in /tmp/id_rsa_temp -out /tmp/id_rsa_decrypted

# 3. Verify it looks correct
head -1 /tmp/id_rsa_decrypted
# should show: -----BEGIN RSA PRIVATE KEY----- (without Proc-Type or DEK-Info)

# 4. Import into Proton Pass (no --password, the key is decrypted)
pass-cli item create ssh-key import \
  --from-private-key /tmp/id_rsa_decrypted \
  --vault-name "SSH Keys" \
  --title "my-rsa-key"

# 5. Secure cleanup immediately
shred -u /tmp/id_rsa_decrypted /tmp/id_rsa_temp

---

Storing the passphrase in the item (for auto-unlock via agent)

After importing, add the passphrase as a hidden custom field. The Proton Pass SSH agent will use it automatically when loading the key.

# Get the item-id if needed
pass-cli item list "SSH Keys" --output json

# Add the passphrase
pass-cli item update \
  --vault-name "SSH Keys" \
  --item-title "my-rsa-key" \
  --field "passphrase=my_passphrase"

---

3. SSH Agent daemon

pass-cli ssh-agent start runs in the foreground. Use the daemon mode instead:

# Start the daemon
pass-cli ssh-agent daemon start \
  --vault-name "SSH Keys" \
  --log-file ~/.ssh/proton-pass-agent.log

# Check status
pass-cli ssh-agent daemon status

# Stop
pass-cli ssh-agent daemon stop

The daemon reuses the existing pass-cli session — you must be logged in first.

---

4. Startup script

The daemon requires an active session. Use this script to handle login and daemon startup automatically at the beginning of your KDE session.

Create ~/.local/bin/proton-ssh-agent.sh:

#!/bin/bash

if pass-cli test > /dev/null 2>&1; then
    echo "Already logged in, starting SSH agent daemon..."
else
    echo "Not logged in, starting Proton Pass authentication..."

    pass-cli login 2>&1 | while IFS= read -r line; do
        echo "$line"
        if [[ "$line" =~ https?://[^[:space:]]+ ]]; then
            # xdg-open without & to allow KDE to set focus on the browser
            xdg-open "${BASH_REMATCH[0]}"
        fi
    done
fi

# Start daemon if not already running
if ! pass-cli ssh-agent daemon status | head -n 1 | grep -q "running" > /dev/null 2>&1; then
    if pass-cli ssh-agent daemon start \
        --vault-name "SSH Keys" \
        --log-file ~/.ssh/proton-pass-agent.log > /dev/null 2>&1; then
        echo "SSH agent started successfully"
    else
        echo "Failed to start SSH agent, check ~/.ssh/proton-pass-agent.log"
    fi
fi

chmod +x ~/.local/bin/proton-ssh-agent.sh

---

5. KDE autostart

Add the script to KDE autostart so it runs at session login:

Via KDE System Settings: System Settings → Autostart → Add → Script → select ~/.local/bin/proton-ssh-agent.sh

Or manually:

mkdir -p ~/.config/autostart-scripts
ln -s ~/.local/bin/proton-ssh-agent.sh ~/.config/autostart-scripts/proton-ssh-agent.sh

---

6. KDE focus configuration (required for browser auto-focus)

For xdg-open to properly bring the browser to the foreground during web login, KDE must be configured to allow focus stealing:

System Settings → Window Management → Window Behavior → Focus tab:

• Focus stealing prevention → set to None

Without this setting, KDE will block the browser from taking focus and you will only see a notification in the taskbar.

---

7. Shell configuration

In ~/.zshrc (or ~/.bashrc):

# Proton Pass SSH Agent socket
export SSH_AUTH_SOCK="$HOME/.ssh/proton-pass-agent.sock"

# Disable ksshaskpass (KDE) to avoid spurious popups
unset SSH_ASKPASS
unset SSH_ASKPASS_REQUIRE

Reload:

source ~/.zshrc

---

8. Useful commands

# Check login status
pass-cli test
pass-cli info

# Agent status
pass-cli ssh-agent daemon status

# Restart the agent
pass-cli ssh-agent daemon stop && pass-cli ssh-agent daemon start \
  --vault-name "SSH Keys" \
  --log-file ~/.ssh/proton-pass-agent.log

# List loaded keys
ssh-add -l

# List items in the SSH vault
pass-cli item list "SSH Keys"