3 ms·

Here you go: Simple GPG setup: https://github.com/lrvick/security-token-docs/blob/master/Use_Cases/GPG/Simple_Setup.md https://github.com/lrvick/security-token

by lrvick 10y ago

Here you go: Simple GPG setup: https://github.com/lrvick/security-token-docs/blob/master/Use_Cases/GPG/Simple_Setup.md https://github.com/lrvick/security-token-docs/blob/master/Us... Advanced GPG setup with backups: https://github.com/lrvick/security-token-docs/blob/master/Use_Cases/GPG/Advanced_Setup.md https://github.com/lrvick/security-token-docs/blob/master/Us... SSH Setup: https://github.com/lrvick/security-token-docs/blob/master/Use_Cases/SSH.md https://github.com/lrvick/security-token-docs/blob/master/Us... I also will be adding an alternate "quick ssh setup" guide via PKCS#11 flows to just store an existing ssh private key. Still I think GPG is the way to go in general given all the other use cases it opens up. Please file issues with anything you want to see! I have a lot of unpublished content I can get polished/up if people care.

tptacek 10y ago
"You should disable any other keys that aren't backed by a security token" ... why? You don't need a security token to physically secure a backup key; just put it on a USB drive and stick it in a safe (or a sock drawer). Security tokens are a nice little bonus for security, and they're a major corrective for the kinds of real-world attacks that screw real people over, like phishing (and dumb passwords). But they're pretty marginal against the kinds of attackers who will target SSH keys. Don't get fetishistic about them; at bottom, for serious systems security, they're mostly cosmetic. It feels good to say that all your SSH keys are held in secure devices, but it doesn't mean much.
- lrvick 10y ago
  It means a lot because I have to physically touch the device every single time I ssh. I can even do agent fowarding taboos and know an attacker can't go creating new connections on that agent without a physical action from me each and every time. Compare this to how ssh keys are normally used. You use it once, type in a keyloggable passphrase, and the key is unpacked plaintext into system memory for, in most cases, the rest of the time the system is booted. You could invalidate the passphrase after every connection but this puts an unreasonable amount of work on the developer. Simply tapping once for each connection and having no way for an attacker to avoid that is a great middle ground, imo. Particularly for high level production keys.
  - tptacek 10y ago
    You're making a comparison to an example I didn't cite. I'm not saying that you should have software-only SSH keys on your computer alongside your Y4 SSH pubkey.
    - lrvick 10y ago
      I was mostly responding to: "But they're pretty marginal against the kinds of attackers who will target SSH keys." I am arguing it is not all that marginal. If the only non 0-day way into production is via ssh to a bastion host with a touch-based hardware token then their lives are more than marginally harder than an on-disk key.
lighttower 10y ago
Yubikey documentation for setting up ssh gpg and system login is ... Well, I couldn't find it when I looked circa 18 months ago. Thank you for this.

by lrvick 10y ago

tptacek 10y ago

"You should disable any other keys that aren't backed by a security token" ... why? You don't need a security token to physically secure a backup key; just put it on a USB drive and stick it in a safe (or a sock drawer). Security tokens are a nice little bonus for security, and they're a major corrective for the kinds of real-world attacks that screw real people over, like phishing (and dumb passwords). But they're pretty marginal against the kinds of attackers who will target SSH keys. Don't get fetishistic about them; at bottom, for serious systems security, they're mostly cosmetic. It feels good to say that all your SSH keys are held in secure devices, but it doesn't mean much.

lrvick 10y ago
It means a lot because I have to physically touch the device every single time I ssh. I can even do agent fowarding taboos and know an attacker can't go creating new connections on that agent without a physical action from me each and every time. Compare this to how ssh keys are normally used. You use it once, type in a keyloggable passphrase, and the key is unpacked plaintext into system memory for, in most cases, the rest of the time the system is booted. You could invalidate the passphrase after every connection but this puts an unreasonable amount of work on the developer. Simply tapping once for each connection and having no way for an attacker to avoid that is a great middle ground, imo. Particularly for high level production keys.
- tptacek 10y ago
  You're making a comparison to an example I didn't cite. I'm not saying that you should have software-only SSH keys on your computer alongside your Y4 SSH pubkey.
  - lrvick 10y ago
    I was mostly responding to: "But they're pretty marginal against the kinds of attackers who will target SSH keys." I am arguing it is not all that marginal. If the only non 0-day way into production is via ssh to a bastion host with a touch-based hardware token then their lives are more than marginally harder than an on-disk key.

lighttower 10y ago

Yubikey documentation for setting up ssh gpg and system login is ... Well, I couldn't find it when I looked circa 18 months ago. Thank you for this.