5 ms·

I just recently started using my Yubikeys (in Challenge-Response mode) w/ LUKS to unlock my drives at boot -- it's pretty neat! On my primary system (a worksta

I just recently started using my Yubikeys (in Challenge-Response mode) w/ LUKS to unlock my drives at boot -- it's pretty neat! On my primary system (a workstation, at home), I use the Yubikey to house my GPG keys and I use the "derived" SSH key that lives inside of it for authenticating to everything at $work. It was a bit of a PITA to get working -- points at gnome keyring -- but it works great. I have a Nano I'm about to set up the same way and just leave it in my primary laptop permanently.

SEJeff 10y ago
What was the gist of it? I use LUKS with a pretty strong password on Fedora 25 and have a few Yubikeys I need to put to good use.
- jlgaddis 10y ago
  gnome-keyring replaces gpg-agent and ssh-agent (on the system) but doesn't actually include all the functionality... basically, disable GPG/SSH agent support in gnome-keyring (if it's running -- and it's quite often automatically launched, even if you aren't aware of/expecting it), and explicitly use the real agent instead. You can find the details on Google, but it's one of things that you wouldn't even know was a problem to be aware of. Edit: Sorry... for LUKS, write a custom initramfs hook (shell script, in my case) to prompt the user for a "passphrase", use that as the challenge sent to the Yubikey, read the response from the Yubikey, write that to /crypto_keyfile.bin (in the initramfs, so not on disk), and the "encrypt" hook should use that file as the key to unlock the disk. You'll have to do it by hand once so that you can add the key (response) to a slot in LUKS. There's examples on Github of this but of course I didn't find them until I had already figured it out myself.
- jeffmcjunkin 10y ago
  Amusingly I just ran across this[0] link an hour or so before this HN post went live. I haven't done it yet, but it looks pretty reasonable. I prefer not to mix LUKS with random many-year-old GitHub repos. [0] http://askubuntu.com/a/599826 http://askubuntu.com/a/599826
- mmozeiko 10y ago
  Take a look at this: https://github.com/agherzan/yubikey-full-disk-encryption https://github.com/agherzan/yubikey-full-disk-encryption
elithrar 10y ago
> I have a Nano I'm about to set up the same way and just leave it in my primary laptop permanently. Do I misunderstand the purpose of a Yubikey/U2F device here? Is not leaving it plugged in permanently effectively reducing the strength of the second factor? With TOTP codes behind my iPhone lock screen I can be reasonably confident that stealing my laptop isn't enough to break into my accounts (buying time until I can contact our SIRT team), but with a device plugged in permanently I lose that. Obviously an attacker would have to know my password, but that assumption is a primary reason for multi-factor auth to begin with. What am I missing?
- idlewords 10y ago
  The big win from a U2F device permanently plugged in to the laptop is as a defense against phishing.
- petee 10y ago
  I believe its like using it as an HSM; keys are protected against a remote intruder copying them, but physical access is another issue - you should still use it in conjunction with something-you-know, then it doesn't matter if the laptop is stolen.
- jlgaddis 10y ago
  Leaving it in permanently is mostly for convenience. The keys are still protected (by a "PIN") even if the laptop and/or Yubikey is stolen. There's also FDE on the laptop itself, protecting the data.
  - hdhzy 10y ago
    You can also turn on touch-to-use policy so that you have to touch the yubikey each time you want to use the key.
    - hvidgaard 10y ago
      This is important. Physical action outside the computer should be required to access keys, otherwise a root access is enough to completely compromise the system.
rkeene2 10y ago
I use a smartcard with an RSA key with a LUKS-like format to encrypt my disks -- uses AES256-XTS for the actual dm-crypt, the smartcard's key is used to encrypt the symmetric cipher key.

SEJeff 10y ago

What was the gist of it? I use LUKS with a pretty strong password on Fedora 25 and have a few Yubikeys I need to put to good use.

jlgaddis 10y ago
gnome-keyring replaces gpg-agent and ssh-agent (on the system) but doesn't actually include all the functionality... basically, disable GPG/SSH agent support in gnome-keyring (if it's running -- and it's quite often automatically launched, even if you aren't aware of/expecting it), and explicitly use the real agent instead. You can find the details on Google, but it's one of things that you wouldn't even know was a problem to be aware of. Edit: Sorry... for LUKS, write a custom initramfs hook (shell script, in my case) to prompt the user for a "passphrase", use that as the challenge sent to the Yubikey, read the response from the Yubikey, write that to /crypto_keyfile.bin (in the initramfs, so not on disk), and the "encrypt" hook should use that file as the key to unlock the disk. You'll have to do it by hand once so that you can add the key (response) to a slot in LUKS. There's examples on Github of this but of course I didn't find them until I had already figured it out myself.
jeffmcjunkin 10y ago
Amusingly I just ran across this[0] link an hour or so before this HN post went live. I haven't done it yet, but it looks pretty reasonable. I prefer not to mix LUKS with random many-year-old GitHub repos. [0] http://askubuntu.com/a/599826 http://askubuntu.com/a/599826
mmozeiko 10y ago
Take a look at this: https://github.com/agherzan/yubikey-full-disk-encryption https://github.com/agherzan/yubikey-full-disk-encryption

elithrar 10y ago

> I have a Nano I'm about to set up the same way and just leave it in my primary laptop permanently. Do I misunderstand the purpose of a Yubikey/U2F device here? Is not leaving it plugged in permanently effectively reducing the strength of the second factor? With TOTP codes behind my iPhone lock screen I can be reasonably confident that stealing my laptop isn't enough to break into my accounts (buying time until I can contact our SIRT team), but with a device plugged in permanently I lose that. Obviously an attacker would have to know my password, but that assumption is a primary reason for multi-factor auth to begin with. What am I missing?

idlewords 10y ago
The big win from a U2F device permanently plugged in to the laptop is as a defense against phishing.
petee 10y ago
I believe its like using it as an HSM; keys are protected against a remote intruder copying them, but physical access is another issue - you should still use it in conjunction with something-you-know, then it doesn't matter if the laptop is stolen.
jlgaddis 10y ago
Leaving it in permanently is mostly for convenience. The keys are still protected (by a "PIN") even if the laptop and/or Yubikey is stolen. There's also FDE on the laptop itself, protecting the data.
- hdhzy 10y ago
  You can also turn on touch-to-use policy so that you have to touch the yubikey each time you want to use the key.
  - hvidgaard 10y ago
    This is important. Physical action outside the computer should be required to access keys, otherwise a root access is enough to completely compromise the system.

rkeene2 10y ago

I use a smartcard with an RSA key with a LUKS-like format to encrypt my disks -- uses AES256-XTS for the actual dm-crypt, the smartcard's key is used to encrypt the symmetric cipher key.