5 ms·

i bought a yubikey to do this. and after a while installing gpg and creating master keys and subkeys, and dealing with the usual 'there are 4 different verions

i bought a yubikey to do this. and after a while installing gpg and creating master keys and subkeys, and dealing with the usual 'there are 4 different verions of recipes to do this and none of them seem to work anymore', i gave up. this seems like such an overwhelmingly common use case I dont understand why yubico doesnt make this as frictionless as possible. i understand that the smart card spec is probably a hindrance, but still.. but its still on my (physical) keychain, looking forward to trying your non-gpg workflow. thanks for posting.

naggie 8y ago
I almost gave up too, but after (admittedly) a lot of battling I finally got GPG to work well with my yuibkeys, allowing a portable SSH/GPG identity using a single yubikey over several machines. I also got GPG agent forwarding to work transparently and with improved security by forwarding a dynamically created unix socket instead of a TCP socket. It allows me to do remote code signing, as well as chain through a bastion host. Aside from jamming up with ansible occasionally, the setup is reliable. I've documented the process for my own reference as much as I could here (yep, a fifth guide): https://github.com/naggie/dotfiles/blob/master/etc/yubikey.md https://github.com/naggie/dotfiles/blob/master/etc/yubikey.m... -- see functions.sh in the same repository for some mechanisms to automatically manage gpg-agent and the sockets without getting deadlocked. I hope someone finds this useful. I'll certainly be trying the opensc method here though, out of interest.
- philsnow 8y ago
  You're talking about forwarding the GPG agent, so I was worried that you hadn't found the touch-to-sign setting, but indeed you had. Do you have a strong opinion on `on` vs `fixed` ? I tell myself that I should use fixed but haven't bitten the bullet yet.
  - StreakyCobra 8y ago
    I set it to `on`. I read somewhere on internet an argument why `fixed` is not really necessary: for setting it back to `off` you need the admin PIN, and you have only 3 tries (by default) for the password. So I am not really worried about someone managing to disable it. And that keep the possibility to change my mind later on open, without having to reset the key.
    - naggie 8y ago
      I have it on -- if my Yubikey is locked out or lost, it's not a problem as I have a backup of the master key in my safe. I could revoke the subkeys if the yubikey is stolen, or trust that whoever finds the yubikey has only three attempts on the pin. Also I further mitigate the risk by having an explicit wrapper (gssh) to be selective about when I forward GPG/SSH agent.
- bedros 8y ago
  what's the process of restoring to a backup key in case this key is lost or destroyed in laundry for example
  - bonzini 8y ago
    The private keys are in a subdirectory under .gpg before you move them to the card. Just back those up and store them in a safe place. The ash and signing subkeys can be replaced easily, but if you lose the encryption subkey you won't be able to decrypt anything that was sent to you in the past.
- bonzini 8y ago
  > I also got GPG agent forwarding to work transparently I found that forwarding the scdaemon socket is more reliable. I configure GPG on the remote machine to use netcat as scdaemon.
  - naggie 8y ago
    That's a nice idea. I assume you use a unix socket to mitigate another user taking control by connecting to the TCP port?
    - bonzini 8y ago
      Yes, I use ssh Unix socket forwarding.
cbhl 8y ago
Yubico is probably doing fine selling security keys to billion-dollar tech companies, who simply need compatibility with the existing ssh-yubikey-certificate setup.
- dboreham 8y ago
  The whole point of Yubico is that they're selling to smaller customers. It was always possible for megacorps to deploy smartcards.
chiefalchemist 8y ago
I saw this (in the article): To get started, you need the following packages: ykpers (library and tools to program Yubikeys) yubico-piv-tool (Yubico Personal Identity Verification (PIV) Tool) pcsc-lite (resource manager for PC/SC) opensc (set of libraries and utilities to access smart cards) And the first thing I thought was "sure to be a guaranteed cluster fuck." Can't there be a better way already? We all know sec is a big deal. Don't we?
- ak217 8y ago
  Yes, I agree Yubico's libraries and tools leave a lot to be desired. A lot of the functionality in these tools is broken, or requires unnecessary extra configuration, or is encumbered with dependencies that are broken. The specific "smartcard" protocol that Yubico uses for this functionality is well-supported by the three major operating systems, though (winscard is a standard library on Windows, PCSC.framework is standard on Mac OS, and libpcsclite is available on Linux by installing pcscd/pcsc-lite). I recently implemented a library (https://github.com/pyauth/exile https://github.com/pyauth/exile) to use Yubikeys to sign AWS API requests, which required writing a Python ctypes API to talk to these libraries. It turned out to be fairly easy once I threw away the idea that I should rely on any of the libraries you listed, and just started talking via the winscard/PCSC protocol directly. If anyone wants to write something similar for this application, the ctypes bindings are in https://github.com/pyauth/exile/tree/master/exile/scard https://github.com/pyauth/exile/tree/master/exile/scard, and https://github.com/pyauth/exile/blob/master/exile/ykoath https://github.com/pyauth/exile/blob/master/exile/ykoath contains an example of how to use them.
simias 8y ago
What was the problem exactly? I have been using a yubikey for years for this exact purpose without too much hassle. That being said I do use it through GPG agent. I'm not really sure why TFA dislikes this method, I didn't encounter any significant issues setting it up and it means I can use my yubikey for everything that can use GnuPG (signing git commits, encrypting emails, pass...). Actually there is one pain point: every time I install a new system I have to remember to install the right packages and udev rules to be able to communicate with my yubikey from gnupg as a non-priviledged user. But once it works it just works and it's a significant quality of life and security improvement.
- ams6110 8y ago
  TFA is from an OpenBSD-oriented blog, and they tend to avoid gnu software if there is another way.
xaduha 8y ago
You can buy a smartcard reader, some blank javacards and install this https://github.com/philipWendland/IsoApplet https://github.com/philipWendland/IsoApplet, seamless enough. I've been using it for about 3 years now I think. Other stuff you can do with smartcards https://github.com/EnigmaBridge/javacard-curated-list https://github.com/EnigmaBridge/javacard-curated-list
- sansnomme 8y ago
  Can you explain more?
  - xaduha 8y ago
    Go to Aliexpress or Ebay and search for JCOP. JCOP 3 should be contactless cards, JCOP 21 - not. Order whichever you want and then look for a card reader to match, keyword here is CCID. Some stuff you might see might be expensive, especially on Ebay, don't buy expensive stuff. Once you have them use these guides to install https://github.com/philipWendland/IsoApplet/wiki/Installation-of-the-IsoApplet https://github.com/philipWendland/IsoApplet/wiki/Installatio... https://github.com/philipWendland/IsoApplet/wiki/Initialization https://github.com/philipWendland/IsoApplet/wiki/Initializat...
odensc 8y ago
Another plug for: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide
- andbberger 8y ago
  I'll add my vote for the drduh guide. Been using it for some time with no problems.
- stingraycharles 8y ago
  This is the one guide that finally managed to get everything working for me, and I occasionally use it as a reference still. Highly recommended!
seqizz 8y ago
I did that. But I have to connect multiple hosts in my environment, mostly via a tool like polysh. And the performance of gpg-agent was just painful..

naggie 8y ago

I almost gave up too, but after (admittedly) a lot of battling I finally got GPG to work well with my yuibkeys, allowing a portable SSH/GPG identity using a single yubikey over several machines. I also got GPG agent forwarding to work transparently and with improved security by forwarding a dynamically created unix socket instead of a TCP socket. It allows me to do remote code signing, as well as chain through a bastion host. Aside from jamming up with ansible occasionally, the setup is reliable. I've documented the process for my own reference as much as I could here (yep, a fifth guide): https://github.com/naggie/dotfiles/blob/master/etc/yubikey.md https://github.com/naggie/dotfiles/blob/master/etc/yubikey.m... -- see functions.sh in the same repository for some mechanisms to automatically manage gpg-agent and the sockets without getting deadlocked. I hope someone finds this useful. I'll certainly be trying the opensc method here though, out of interest.

philsnow 8y ago
You're talking about forwarding the GPG agent, so I was worried that you hadn't found the touch-to-sign setting, but indeed you had. Do you have a strong opinion on `on` vs `fixed` ? I tell myself that I should use fixed but haven't bitten the bullet yet.
- StreakyCobra 8y ago
  I set it to `on`. I read somewhere on internet an argument why `fixed` is not really necessary: for setting it back to `off` you need the admin PIN, and you have only 3 tries (by default) for the password. So I am not really worried about someone managing to disable it. And that keep the possibility to change my mind later on open, without having to reset the key.
  - naggie 8y ago
    I have it on -- if my Yubikey is locked out or lost, it's not a problem as I have a backup of the master key in my safe. I could revoke the subkeys if the yubikey is stolen, or trust that whoever finds the yubikey has only three attempts on the pin. Also I further mitigate the risk by having an explicit wrapper (gssh) to be selective about when I forward GPG/SSH agent.
bedros 8y ago
what's the process of restoring to a backup key in case this key is lost or destroyed in laundry for example
- bonzini 8y ago
  The private keys are in a subdirectory under .gpg before you move them to the card. Just back those up and store them in a safe place. The ash and signing subkeys can be replaced easily, but if you lose the encryption subkey you won't be able to decrypt anything that was sent to you in the past.
bonzini 8y ago
> I also got GPG agent forwarding to work transparently I found that forwarding the scdaemon socket is more reliable. I configure GPG on the remote machine to use netcat as scdaemon.
- naggie 8y ago
  That's a nice idea. I assume you use a unix socket to mitigate another user taking control by connecting to the TCP port?
  - bonzini 8y ago
    Yes, I use ssh Unix socket forwarding.

cbhl 8y ago

Yubico is probably doing fine selling security keys to billion-dollar tech companies, who simply need compatibility with the existing ssh-yubikey-certificate setup.

dboreham 8y ago
The whole point of Yubico is that they're selling to smaller customers. It was always possible for megacorps to deploy smartcards.

chiefalchemist 8y ago

I saw this (in the article): To get started, you need the following packages: ykpers (library and tools to program Yubikeys) yubico-piv-tool (Yubico Personal Identity Verification (PIV) Tool) pcsc-lite (resource manager for PC/SC) opensc (set of libraries and utilities to access smart cards) And the first thing I thought was "sure to be a guaranteed cluster fuck." Can't there be a better way already? We all know sec is a big deal. Don't we?

ak217 8y ago
Yes, I agree Yubico's libraries and tools leave a lot to be desired. A lot of the functionality in these tools is broken, or requires unnecessary extra configuration, or is encumbered with dependencies that are broken. The specific "smartcard" protocol that Yubico uses for this functionality is well-supported by the three major operating systems, though (winscard is a standard library on Windows, PCSC.framework is standard on Mac OS, and libpcsclite is available on Linux by installing pcscd/pcsc-lite). I recently implemented a library (https://github.com/pyauth/exile https://github.com/pyauth/exile) to use Yubikeys to sign AWS API requests, which required writing a Python ctypes API to talk to these libraries. It turned out to be fairly easy once I threw away the idea that I should rely on any of the libraries you listed, and just started talking via the winscard/PCSC protocol directly. If anyone wants to write something similar for this application, the ctypes bindings are in https://github.com/pyauth/exile/tree/master/exile/scard https://github.com/pyauth/exile/tree/master/exile/scard, and https://github.com/pyauth/exile/blob/master/exile/ykoath https://github.com/pyauth/exile/blob/master/exile/ykoath contains an example of how to use them.

simias 8y ago

What was the problem exactly? I have been using a yubikey for years for this exact purpose without too much hassle. That being said I do use it through GPG agent. I'm not really sure why TFA dislikes this method, I didn't encounter any significant issues setting it up and it means I can use my yubikey for everything that can use GnuPG (signing git commits, encrypting emails, pass...). Actually there is one pain point: every time I install a new system I have to remember to install the right packages and udev rules to be able to communicate with my yubikey from gnupg as a non-priviledged user. But once it works it just works and it's a significant quality of life and security improvement.

ams6110 8y ago
TFA is from an OpenBSD-oriented blog, and they tend to avoid gnu software if there is another way.

xaduha 8y ago

You can buy a smartcard reader, some blank javacards and install this https://github.com/philipWendland/IsoApplet https://github.com/philipWendland/IsoApplet, seamless enough. I've been using it for about 3 years now I think. Other stuff you can do with smartcards https://github.com/EnigmaBridge/javacard-curated-list https://github.com/EnigmaBridge/javacard-curated-list

sansnomme 8y ago
Can you explain more?
- xaduha 8y ago
  Go to Aliexpress or Ebay and search for JCOP. JCOP 3 should be contactless cards, JCOP 21 - not. Order whichever you want and then look for a card reader to match, keyword here is CCID. Some stuff you might see might be expensive, especially on Ebay, don't buy expensive stuff. Once you have them use these guides to install https://github.com/philipWendland/IsoApplet/wiki/Installation-of-the-IsoApplet https://github.com/philipWendland/IsoApplet/wiki/Installatio... https://github.com/philipWendland/IsoApplet/wiki/Initialization https://github.com/philipWendland/IsoApplet/wiki/Initializat...

odensc 8y ago

Another plug for: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide

andbberger 8y ago
I'll add my vote for the drduh guide. Been using it for some time with no problems.
stingraycharles 8y ago
This is the one guide that finally managed to get everything working for me, and I occasionally use it as a reference still. Highly recommended!

seqizz 8y ago

I did that. But I have to connect multiple hosts in my environment, mostly via a tool like polysh. And the performance of gpg-agent was just painful..