Howto login on headless servers

[Basti-Fantasti]

Hi

is there a way to log in from one server to another which has no browser and gui installed to call the auth server?

I'm currently trying to establish the connection between several VPS running debian.
I can connect from my Windows client to the servers using the opkssh, but I'm not sure on how to create the keys for a remote server on which I'm also only connected by SSH

Is there a way to do so?

[EthanHeilman]

@Basti-FantastiThis is highly requested feature, but it currently does not work out of the box. Below I list two workarounds.

There is are two workaround for ssh clients running on headless servers.

1. You can generate the key pair on your windows machine and then copy it to the headless machine and use it from there.
2. You can generate the key pair on your windows machine, setup ssh-agent, then copy the key pair into ssh-agent and use key forwarding.

Both of these should work, but they require either manual effort or writing a script to automate it.

We are planning to add full support, but the feature isn't available yet.

• One planned way of support this is to add support for ssh-agent and then using ssh-agent's key forward capability so that the key generated on your windows machine can be used over multiple hops. This is a lot of interest in this and some work was being done in this PR but it lost momentum. It is at the top of TODO pile, but won't happen until Q1 or Q2 2026 unless someone champions it. login: support ssh-agent for certificates #96
• Another way to support this, which is almost done, is to use the oidc-device flow which can be run headlessly. There is a nearly complete PR to add this to OpenPubkey here feat: device flow support. openpubkey#340 It should be merged very soon and then we will add support for OPKSSH.

See also discussion here
#327

[Basti-Fantasti]

Hi and thanks for the detailed answer.
I did the steps described at 1) as a workaround.
But I also think using the ssh-agent in the background would be awesome, because it could really simplify the SSH handling when hopping from PC to PC.

I'll also look into the oidc device flow. This also sounds interesting.

[EthanHeilman]

@Basti-Fantasti Would love have ssh-agent! People were working on it, but I had two many other PRs at the time and didn't manage to get feedback to them fast enough and as a result the PR lost momentum. Next time it is top of the queue, I'm going to make it my highest priority to get it merged.

[Basti-Fantasti]

@EthanHeilman what status is the #96 PR at or what is missing?
Maybe I can assist a bit...

[EthanHeilman]

@Basti-Fantasti The main thing is that it is half a year out of date. Ping the author of the PR in the PR and see what they think. Would be great to get momentum started on it