4 ms·
The best way to store SSH private keys is in a hardware security module, or HSM. I have three Yubikeys. Would I need to add three ssh keys to every one of my s
by blfr 7y ago
The best way to store SSH private keys is in a hardware security module, or HSM.
I have three Yubikeys. Would I need to add three ssh keys to every one of my ssh accounts?
- xenophonf 7y agoYes. If one Yubikey were lost, stolen, or damaged, you would then revoke its access by removing the corresponding entry in ~/.ssh/authorized_keys.
- eaguyhn 7y agoThere are sites that show how to move your key to multiple Yubikeys. (Basically, backup your keyring before moving to Yubikey, then restore and repeat move to a new Yubikey). This is the guide I followed: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide
- sneak 7y agoYou can load keys into yubikeys if you like (and thus load the same key into multiple devices), but I choose to generate unique keys on-device, so each one has its own (which would make the answer to your question “yes”). One upside though is that all your keys can go as individual lines in authorized_keys, so there is still only one file to install on remote machines.
- jolmg 7y agoUnless you put the same OpenPGP key on all of them, or you want them to have a different levels of access.