SSH Socket (.bitwarden-ssh-agent.sock) locks up after successful SSH connection.

[Verex]

Steps To Reproduce

1. Install Bitwarden and configure for MacOS (following the guide Configure Bitwarden SSH agent)
2. Launch the Bitwarden desktop application (MacOS)
3. Authenticate and unlock vault (in my case using FaceID or pin).
4. Click allow on “Bitwarden” would like to access data from other apps. system prompt that shows up every time.
5. Run ssh-add -L (public keys listed).
6. SSH into a remote target (e.g. run ssh <user>@<host>).
7. Accept prompt in Bitwarden to allow authentication.
8. Exit SSH session.
9. Run ssh-add -L or try to SSH again.

Expected Result

• ssh-add -L should list public key parameters of all identities.
• ssh <user>@<host> should open Bitwarden prompt to accept authentication.

Actual Result

• ssh-add -L will hang until Bitwarden is closed (which then prints error fetching identities: communication with agent failed) or until you send SIGINT (^C).
  • Note: Running ssh-add -L after Bitwarden application is closed will print Error connecting to agent: Connection refused.
• ssh <user>@<host> will hang until Bitwarden is closed or until you send SIGINT (^C).

Screenshots or Videos

No response

Additional Context

No response

Operating System

macOS

Operating System Version

15.2

Installation method

Direct Download (from bitwarden.com)

Build Version

2025.1.3 (36834)

Issue Tracking Info

• I understand that work is tracked outside of GitHub. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for reporting this issue! We've added this to our internal tracking system.
ID: PM-17880

[defenestration]

This seems to happen on to me on Windows 11 as well. Same client version 2025.1.3.

• start bitwarden
• Notice that ssh-add -l will list my keys as expected at this time.
• Ssh into a server which has bitwarden prompt to authorize the key.
• SSH to the server succeeds, and can log out.
• But then ssh-add -l will hang until i close and restart the bitwarden client.

Note the client otherwise behaves normally, as in you can browse for passwords and such.

[othyn]

This has also happened to be a few times, only fix is to restart the Bitwarden client.

[quexten]

Hi, to anyone experiencing this; are you using SSH agent forwarding by any chance?

[defenestration]

I think this happened regardless of using forwarding or not.

…

On Mon, Feb 3, 2025, 2:18 PM Bernd Schoolmann ***@***.***> wrote: Hi, to anyone experiencing this; are you using SSH agent forwarding by any chance? — Reply to this email directly, view it on GitHub <#13206 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHKU2TSSURNTKENG4VTQL32N66HJAVCNFSM6AAAAABWJYLOBGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMZRHA3DKMZXGE> . You are receiving this because you commented.Message ID: ***@***.***>

[Verex]

@quexten I can confirm that for the host used in my repro that ForwardAgent was enabled.

I was unable to reproduce this issue on that same host with ForwardAgent disabled.

Will see if I catch this happening again without ForwardAgent as I'm not certain whether I've encountered on other hosts.

[defenestration]

Seems that I also had FowardAgent in some old configs. I confirmed that disabling it seems to allow reconnections to work.

…

On Mon, Feb 3, 2025 at 6:33 PM Verex ***@***.***> wrote: @quexten <https://github.com/quexten> I can confirm that for the host used in my repro that ForwardAgent was enabled. I was unable to reproduce this issue on that same host with ForwardAgent disabled. Will see if I catch this happening again without ForwardAgent as I'm not certain whether I've encountered on other hosts. — Reply to this email directly, view it on GitHub <#13206 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHKU2XMNQXGXXPVEGUWHQL2N74F3AVCNFSM6AAAAABWJYLOBGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMZSGQYTIOJUG4> . You are receiving this because you commented.Message ID: ***@***.***>

[othyn]

I also found removing ForwardAgent yes from my ~/.ssh/config helped. In fact in my case, Bitwarden wouldn't work at all until I removed it.

[quexten]

Yeah, agent forwarding is broken and the fix is pending at the moment, please disable it until then.