3 ms·
What I'd find interesting is using U2F (or FIDO2, which seems to be an evolution of this) as a second factor for SSH logins. But that doesn't seem possible with
by fabian2k 9y ago
What I'd find interesting is using U2F (or FIDO2, which seems to be an evolution of this) as a second factor for SSH logins. But that doesn't seem possible without changes to SSH itself.
And I hope that this might trigger more widespread support for U2F and similar mechanisms in browsers and websites.
- floatboth 9y agoNo need to touch SSH itself, PAM is a thing (unless you're on OpenBSD). Here's an example of pam-u2f with OpenSSH: https://aprilmacdonald.com/two-factor-ssh-authentication-with-u2f-hardware-security-key/ https://aprilmacdonald.com/two-factor-ssh-authentication-wit... I actually use a Yubikey for SSH in a different way: with gpg-agent. E.g. https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO.html https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO....
- jlgaddis 9y ago> PAM is a thing (unless you're on OpenBSD) And if you are on OpenBSD, there's login_yubikey [0] (although it uses OTP instead of U2F). [0]: https://man.openbsd.org/login_yubikey.8 https://man.openbsd.org/login_yubikey.8