5 ms·

I consider best practice to be using a hardware token. My favoured solution is to use a yubikey via gpg: with this method you use your gpg subkey as an ssh key

I consider best practice to be using a hardware token. My favoured solution is to use a yubikey via gpg: with this method you use your gpg subkey as an ssh key. The yubikey 4 supports RSA 4096 bit keys, if you need NFC then the Yubikey Neo supports max RSA 2048 bit keys.

eeZi 10y ago
This. It's so cheap and easy to use a hardware token for your GPG and SSH keys nowadays (YubiKey 4! TPM! Smartcards!). If you're not using one, you should.
- zerkten 10y ago
  Do you have a list of guides you recommend for getting started with YubiKey?
  - helper 10y ago
    I found this guide to be pretty comprehensive: https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/ https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike...
- spydum 10y ago
  I have tried this for Windows and could not find the right magic to bring my yubico and ssh keys together (keepass otp stinks). What am I missing?
  - daurnimator 10y ago
    I haven't done the setup on windows before; but gpg4win does the auth correctly, and it automatically hooks up to putty!
dsl 10y ago
If you are going to set this up, sit down and spend an hour thinking about your backup and recovery strategy first. I'm familiar with an organization that did a POC for 2FA using them and had a surprisingly high failure rate.
- sneak 10y ago
  I order 3 for each user, and tell them to keep the third somewhere really, really safe.
  - a3n 10y ago
    Maybe the safest thing is to not give them the 3rd one, until they ask you to pull it out of your safe.
sneak 10y ago
The other nice benefit of this is that now you have pgp keys for your organization to which you can encrypt backups and suchlike.
- daurnimator 10y ago
  A good practice to enforce (if you can) is to only share credentials with your coworkers if they're gpg encrypted. e.g. coworker asks for password to some AWS box? encrypt it to their GPG key and email it to them.
  - fragmede 10y ago
    - coworker asks for password to some AWS box? To be clear, GPG encrypted is better than plain text for all sorts of secrets, but using a single account and passing around passwords won't scale. (Or rather the security implications of everybody having root access via a single shared account and passing the password around should frighten you.) Ideally there's some sort of mechanism so all users can login to their own account on servers (from puppetized ssh keys to LDAP, among others), and no one is actually passing around passwords.
rnhmjoj 10y ago
If you don't know already the OpenPGP implementation used in the new Yubykeys is no longer[1] open source. Not that it really matters, since you couldn't verify the running code anyway, but this doesn't make me feel I should trust them. [1]: https://www.techdirt.com/articles/20160515/02094934446/bad-news-two-factor-authentication-pioneer-yubikey-drops-open-source-pgp-proprietary-version.shtml https://www.techdirt.com/articles/20160515/02094934446/bad-n...

eeZi 10y ago

This. It's so cheap and easy to use a hardware token for your GPG and SSH keys nowadays (YubiKey 4! TPM! Smartcards!). If you're not using one, you should.

zerkten 10y ago
Do you have a list of guides you recommend for getting started with YubiKey?
- helper 10y ago
  I found this guide to be pretty comprehensive: https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/ https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike...
spydum 10y ago
I have tried this for Windows and could not find the right magic to bring my yubico and ssh keys together (keepass otp stinks). What am I missing?
- daurnimator 10y ago
  I haven't done the setup on windows before; but gpg4win does the auth correctly, and it automatically hooks up to putty!

dsl 10y ago

If you are going to set this up, sit down and spend an hour thinking about your backup and recovery strategy first. I'm familiar with an organization that did a POC for 2FA using them and had a surprisingly high failure rate.

sneak 10y ago
I order 3 for each user, and tell them to keep the third somewhere really, really safe.
- a3n 10y ago
  Maybe the safest thing is to not give them the 3rd one, until they ask you to pull it out of your safe.

sneak 10y ago

The other nice benefit of this is that now you have pgp keys for your organization to which you can encrypt backups and suchlike.

daurnimator 10y ago
A good practice to enforce (if you can) is to only share credentials with your coworkers if they're gpg encrypted. e.g. coworker asks for password to some AWS box? encrypt it to their GPG key and email it to them.
- fragmede 10y ago
  - coworker asks for password to some AWS box? To be clear, GPG encrypted is better than plain text for all sorts of secrets, but using a single account and passing around passwords won't scale. (Or rather the security implications of everybody having root access via a single shared account and passing the password around should frighten you.) Ideally there's some sort of mechanism so all users can login to their own account on servers (from puppetized ssh keys to LDAP, among others), and no one is actually passing around passwords.

rnhmjoj 10y ago

If you don't know already the OpenPGP implementation used in the new Yubykeys is no longer[1] open source. Not that it really matters, since you couldn't verify the running code anyway, but this doesn't make me feel I should trust them. [1]: https://www.techdirt.com/articles/20160515/02094934446/bad-news-two-factor-authentication-pioneer-yubikey-drops-open-source-pgp-proprietary-version.shtml https://www.techdirt.com/articles/20160515/02094934446/bad-n...