3 ms·

> I /presume/ that no Linux desktop setups today actually support this workflow for user login, I login to my Linux desktops with a Yubikey and its PIN. I have

by jolmg 7y ago

> I /presume/ that no Linux desktop setups today actually support this workflow for user login, I login to my Linux desktops with a Yubikey and its PIN. I have it configured as a OpenPGP smartcard, and to authenticate (for login, raising privileges with sudo, or unlocking the screen, etc.), I use the poldi[1] PAM module. [1] http://git.gnupg.org/cgi-bin/gitweb.cgi?p=poldi.git http://git.gnupg.org/cgi-bin/gitweb.cgi?p=poldi.git

therein 7y ago
One thing that has been frustrating with the OpenPGP setup with the Yubikey has been the inability to re-add the stub key entries after they are deleted from the host. I do edit-card, unlock and fetch but the entry doesn't show, rendering it useless in `gpg`.
- jolmg 7y ago
  "fetch" fetches from the URL you set in the card/Yubikey. If you put the public key on an HTTP server and put the URL in the Yubikey (with the "url" command after enabling "admin" commands), you can fetch it with "fetch". Getting the public key out from an OpenPGP smartcard otherwise is not supported by the protocol it uses. That is frustrating that it wasn't included in the procotol, but I've gotten over it. After you've imported the public key, getting the private key stubs is a matter of checking the status of the card with `gpg --card-status`. The stubs are added then. If you have another machine that has the public key, you can export it with `gpg --export -a $key_identity`, and import it with `gpg --import < $exported_public_key_file`. Otherwise, if you don't hold another copy of the public key, the only option left might be to make a new keypair and be careful to not lose all copies of the public key again. Also, if you backup the private key, you can get the public key from it by importing it somewhere.
  - therein 7y ago
    Thanks. That resolves the issue. But definitely unfortunate public key retrieval wasn't included into the protocol. After unlocking of course.

by jolmg 7y ago

therein 7y ago

One thing that has been frustrating with the OpenPGP setup with the Yubikey has been the inability to re-add the stub key entries after they are deleted from the host. I do edit-card, unlock and fetch but the entry doesn't show, rendering it useless in `gpg`.

jolmg 7y ago
"fetch" fetches from the URL you set in the card/Yubikey. If you put the public key on an HTTP server and put the URL in the Yubikey (with the "url" command after enabling "admin" commands), you can fetch it with "fetch". Getting the public key out from an OpenPGP smartcard otherwise is not supported by the protocol it uses. That is frustrating that it wasn't included in the procotol, but I've gotten over it. After you've imported the public key, getting the private key stubs is a matter of checking the status of the card with `gpg --card-status`. The stubs are added then. If you have another machine that has the public key, you can export it with `gpg --export -a $key_identity`, and import it with `gpg --import < $exported_public_key_file`. Otherwise, if you don't hold another copy of the public key, the only option left might be to make a new keypair and be careful to not lose all copies of the public key again. Also, if you backup the private key, you can get the public key from it by importing it somewhere.
- therein 7y ago
  Thanks. That resolves the issue. But definitely unfortunate public key retrieval wasn't included into the protocol. After unlocking of course.