3 ms·

I think the SOP is to have a second Yubikey registered and stored in a safe place and/or a set of one-time codes that you can use instead.

idlewords 8y ago
I actually had no idea SSH had support for one-time passwords, but I see docs for OTPW here: https://www.digitalocean.com/community/tutorials/install-and-use-otpw https://www.digitalocean.com/community/tutorials/install-and... This looks like exactly the answer I needed; thank you!
- tptacek 8y ago
  It sounds like you're trying to do something like Yubikey OTP or U2F with SSH. Both are doable, but I don't think that's the normal way people use hardware tokens with SSH; what I've seen much more is that people use Y4 keys (which are basically pocket HSMs), generate RSA keypairs with them, and configure SSH to accept the public key on the token. This doesn't require any support on the serverside; as far as the server's concerned, the Y4 is just another RSA key. It does require the more expensive Yubikey, but there are some security advantages to using it.
  - idlewords 8y ago
    No, my thinking is along the lines of what you're describing (generate the key on the Y5 Yubikey so that it never leaves it). The discussion of one-time stuff is just as backup for scenarios where I lose the key, which I invariably will, or need to give other people "break glass in case of emergency" access to the servers.
  - tialaramex 8y ago
    > something like Yubikey OTP or U2F with SSH. Both are doable I would be interested in how you think U2F with SSH is doable. Maybe with a custom SSH server and client? Have you actually see this done in anger?
    - wolf550e 8y ago
      ssh server trusts internal CA, an application that requires U2F login can issue 5 minute certificates signed by the CA, the ssh session does not close when the login cert expires. See https://github.com/Netflix/bless https://github.com/Netflix/bless and https://github.com/gravitational/teleport https://github.com/gravitational/teleport

idlewords 8y ago

I actually had no idea SSH had support for one-time passwords, but I see docs for OTPW here: https://www.digitalocean.com/community/tutorials/install-and-use-otpw https://www.digitalocean.com/community/tutorials/install-and... This looks like exactly the answer I needed; thank you!

tptacek 8y ago
It sounds like you're trying to do something like Yubikey OTP or U2F with SSH. Both are doable, but I don't think that's the normal way people use hardware tokens with SSH; what I've seen much more is that people use Y4 keys (which are basically pocket HSMs), generate RSA keypairs with them, and configure SSH to accept the public key on the token. This doesn't require any support on the serverside; as far as the server's concerned, the Y4 is just another RSA key. It does require the more expensive Yubikey, but there are some security advantages to using it.
- idlewords 8y ago
  No, my thinking is along the lines of what you're describing (generate the key on the Y5 Yubikey so that it never leaves it). The discussion of one-time stuff is just as backup for scenarios where I lose the key, which I invariably will, or need to give other people "break glass in case of emergency" access to the servers.
- tialaramex 8y ago
  > something like Yubikey OTP or U2F with SSH. Both are doable I would be interested in how you think U2F with SSH is doable. Maybe with a custom SSH server and client? Have you actually see this done in anger?
  - wolf550e 8y ago
    ssh server trusts internal CA, an application that requires U2F login can issue 5 minute certificates signed by the CA, the ssh session does not close when the login cert expires. See https://github.com/Netflix/bless https://github.com/Netflix/bless and https://github.com/gravitational/teleport https://github.com/gravitational/teleport