DISCLAIMER

1. I am not sponsored by Trezor / SatoshiLabs. I bought a Trezor recently, and was disappointed by the lack of official information regarding the SSH support and using Trezor's SSH support on macOS. After piecing some information together from around the web, I managed to get SSH support working decently on macOS, and figured I would save people a lot of time by explaining everything in one singular article.
2. I did not invent nor do I / have I ever developed Trezor's products. I am not involved in developing trezor-agent or it's dependencies. If bad things happen to you as a result of following this article, whether loss of coins, loss of data, or getting locked out of your server(s) - I am not responsible.

What is Trezor?

• The ability to use your Trezor as a U2F security token (it can act like a YubiKey)
• Support for using it as a hardware GPG/PGP device
• Support for using it as a password manager
• And recently - support for generating and using SSH keys for authentication when connecting to servers/other devices over SSH.

How much does a Trezor cost?

Trezor SSH Authentication Support

What you need (Requirements)

• A Trezor hardware wallet which has already been setup, unlocked, and plugged into your Mac.
  • While I have only tested this guide against my personal Model T (the more expensive Trezor), it should also work on the lower end Model One - as "SSH" is listed in the features of both devices.
  • The trezor-agent service also works with other hardware wallets, primarily certain Ledger models, and Shapeshift's KeepKey. But again - this article is only going to cover usage with the Trezor.
• A Mac (Hackintosh may work) running OSX High Sierra (10.13), Mojave (10.14), or Catalina (10.15). It may work on older/newer versions of OSX, however these are the supported versions which are listed in the Homebrew formula.
  • Trezor's SSH support also works on Windows, Linux and NixOS - but this guide is only going to be covering macOS - since Trezor does not have any documentation on how to use it on macOS.
• You may also need Trezor Bridge installed for this to work properly. I'm not sure whether it's needed or not, but it will generally improve your Trezor experience overall as it allows Trezor to work with non-Chrome based browsers.
• Basic experience working with the macOS terminal. If you don't know how to use the macOS terminal, then you probably also don't know how to use a Linux shell once you're connected via SSH - so this really shouldn't need to be said...

Install and configure Trezor SSH Agent

Installing trezor-agent

brew install libusb
brew install trezor-agent

Generating an SSH key

Note about key names: From what I'm aware so far, the name of your key (for example johndoe@my-trezor) is very important. The name of your key is used in the derivation process along with your seed - meaning that trezor-agent -e ed25519 johndoe@my-trezor will always generate the same public and private key based on your seed.

trezor-agent -e ed25519 johndoe@my-trezor >> ~/.ssh/trezor.conf

$ cat ~/.ssh/trezor.conf
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcjJR3Ks3+C/BTfH0K2iwEpO+I3WQ6eIPyED4hGx8Pi <ssh://johndoe@my-trezor|ed25519>

Running trezor-agent in the background as a service

mkdir -p ~/.ssh/trezor-agent

wget -O ~/Library/LaunchAgents/trezor.ssh.socket.plist https://cdn.privex.io/extras/configs/trezor.ssh.socket.plist

launchctl load ~/Library/LaunchAgents/trezor.ssh.socket.plist

$ launchctl list | grep -i trezor
95865	0	com.bitcointrezor.trezorBridge.trezord
-       1   Trezor SSH Socket

launchctl start "Trezor SSH Socket"

$ launchctl list | grep -i trezor
95865	0	com.bitcointrezor.trezorBridge.trezord
94975	139	Trezor SSH Socket

$ ls -l ~/.ssh/trezor-agent
total 8
lrwxr-xr-x  1 Someguy123  staff   45 26 Jul 10:56 S.ssh -> /private/tmp/com.apple.launchd.XZqiA1Ijrj/ssh
-rw-r--r--  1 Someguy123  staff  149 26 Jul 10:56 error.log

Using your Trezor SSH key(s)

Copy your SSH public key to remote servers/devices

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcjJR3Ks3+C/BTfH0K2iwEpO+I3WQ6eIPyED4hGx8Pi <ssh://johndoe@my-trezor|ed25519>

pbcopy < ~/.ssh/trezor.conf

# First make sure .ssh actually exists if you aren't sure.
user@some-server ~ $ mkdir ~/.ssh
# Now open up ~/.ssh/authorized_keys with your favourite editor
# and paste the public key onto a new line.
user@some-server ~ $ nano ~/.ssh/authorized_keys

Add the ssh-trez function to your bashrc / zshrc

nano ~/.bashrc

BOLD="" GREEN="" YELLOW="" RESET=""
if [ -t 1 ]; then
    BOLD="$(tput bold)" GREEN="$(tput setaf 2)" YELLOW="$(tput setaf 3)" RESET="$(tput sgr0)"
fi

ssh-trez() {
    >&2 echo -e "${BOLD}${GREEN} [...] Connecting to SSH using parameters:${RESET} $*"
    >&2 echo -e "${YELLOW} [...] Please remember to CONFIRM the login on your Trezor!${RESET}"
    ssh -o 'IdentityAgent ~/.ssh/trezor-agent/S.ssh' "$@"
}

Connecting to an SSH host directly using a Trezor SSH key

ssh-trez root@1.2.3.4

Configuring SSH to always connect to a certain host using Trezor

nano ~/.ssh/config

Host someguy-bsd
    Hostname 178.128.170.247
    User root
    Port 22
    IdentityAgent ~/.ssh/trezor-agent/S.ssh

• The Host line defines arbitrary user set aliases for this SSH host. You can define multiple aliases by separating them with spaces. In my case, I have aliased the host as someguy-bsd.
• The Hostname line defines either the IP address (IPv4 or IPv6), or a domain/hostname which points to the server you're defining.
• The Port line is optional - it defaults to 22 if not specified. However I've included it just to make it clear for anyone who might have SSH on a non-standard port.
• The IdentityAgent line is the most important line. This tells OpenSSH to use the SSH agent located at this UNIX socket file.
  In this case, we're wanting it to use trezor-agent's agent socket located at ~/.ssh/trezor-agent/S.ssh

Connecting to a host defined in ~/.ssh/config

ssh someguy-bsd

References

• SSH via Hardware Wallet on macOS - by RRYTER - The original article which covered some of the key points, but missed out some important information such as how to actually use the plist file
• trezor.ssh.socket.plist file published on Gist by RRYTER - The plist service file written by RRYTER as part of the previously mentioned article - now mirrored on Privex's CDN (with a back reference added in the plist source code)
• https://github.com/romanz/trezor-agent
• https://github.com/romanz/trezor-agent/blob/master/doc/INSTALL.md
• MacOS ‘launchd’ examples - by Alvin Alexander - for understanding where to install the .plist service file
• How to Use launchd to Run Services in macOS - by Kosala Sananthana - for understanding how to load the plist, start it, and confirm it's running etc.

Thanks for reading!

Do you like what I'm doing for Hive?

Don't forget to follow me for more like this.