SSH Agent & X11 Forwarding
Use SSH agent forwarding (1Password, ssh-agent, Pageant) and X11 forwarding in Tempest — keep keys local and run remote GUI apps on Mac/Win/Linux.
Use SSH agent forwarding (1Password, ssh-agent, Pageant) and X11 forwarding in Tempest — keep keys local and run remote GUI apps on Mac/Win/Linux.
Two classic SSH features that Tempest exposes as one-click toggles in the host edit form: agent forwarding (use your local SSH keys on the remote host without copying them) and X11 forwarding (run remote GUI applications on your local desktop).
When you enable agent forwarding, processes on the remote host can use your local SSH keys for outbound SSH — without ever transferring the private keys. The remote ssh invocation talks to your local agent through a forwarded Unix socket.
The classic use case: you SSH into a bastion, then git pull from a private repo that requires your SSH key. Without agent forwarding you'd have to copy your key onto the bastion (insecure). With it, the git invocation transparently uses your laptop's key.
Edit your SSH host → Agent Forwarding → on.
Optional: Agent Path — point at a specific socket. Useful for:
1Password SSH agent — ~/.1password/agent.sock (macOS) or \\.\pipe\openssh-ssh-agent (Windows)
Self-managed ssh-agent — wherever $SSH_AUTH_SOCK points
Save and reconnect.
Once connected, on the remote: ssh-add -L should list your local keys, and ssh other-host should work.
Tempest works seamlessly with 1Password's SSH agent — point Tempest at the 1Password agent socket and your SSH keys are touch-id-protected, never on disk, and synced via your 1Password vault. Each SSH auth attempt prompts 1Password to confirm.
Agent forwarding is part of Tempest Pro.
Agent forwarding lets any process on the remote request a signature from your local agent while you're connected. Don't enable it on hosts you don't fully trust.
Use the agent injection feature (ssh-add -L to verify) to confirm before relying on the forwarded agent.
Run a graphical Linux app remotely and have its window appear on your local desktop. Old-school but still the best way to run a one-off wireshark, gimp, or firefox from a remote box without setting up VNC / RDP.
Edit your SSH host → X11 Forwarding → on.
Optional: set X11 Socket if you have a non-default DISPLAY.
Save and reconnect.
Tempest just opens the SSH X11 channel — you need an X server running on your machine to actually display the windows.
After connecting:
X11 forwarding is part of Tempest Pro.
X11 over SSH is bandwidth-heavy and latency-sensitive — fine on a LAN, painful over a slow VPN. For frequent remote desktop work, consider VNC, RDP, or Mosh + tmux + a CLI workflow instead.
YubiKey & FIDO2 SSH Authentication — pair forwarded agent keys with hardware-backed auth on the remote
SSH Connection Multiplexing — agent forwarding cost is amortized across multiplexed sessions
echo $DISPLAY # should be set, e.g. localhost:10.0
xclock # a clock window appears on your machine