4 ms·

My concern with physical keys is what happens if it stops working?

sneak 6y ago
I have one key permanently in a usb port of each computer, and one on my keychain as a backup (which is also used for U2F and has lightning so works with my phone for 2FA), so five in total, each with their own RSA key for ssh.
danielheath 6y ago
You need two; one stowed safely and only retrieved to enroll a new service, and one to use day-to-day.
- sneak 6y ago
  enroll a new service? we are talking about gpg smartcard usage, for ssh - not u2f 2fa. you don't need the physical key to "enroll", you just keep a copy of its pubkey.
  - tmottabr 6y ago
    the idea is to generate the key in the device, so it never leave the device, therefore you cannot store it somewhere else like another device. So, the ideia is for you to have two devices, each with its own key, the first device you use daily and the second you use store in a safe location. if your first device in daily use stop working or is lost you use the second device you have stored to login to your systems to remove the keys from the lost device and add the keys for a new device that replace it and then store the second device back in a safe location.
darkr 6y ago
Then that key can no longer be used. The solution to this resulting in being permanently locked out is to have more than n+1 redundancy in hardware, and ideally meatware too.
devoutsalsa 6y ago
I'm more worried about simply losing it. I travel a lot.
- GekkePrutser 6y ago
  Just use multiple. That's what I do. As backup you can also use OpenPGP cards which cost much less than a yubikey. Or a cheaper Fido2 token if you use Fido2 for SSH access (I don't yet but it's coming into vogue). An OpenPGP card will cost about a tenner, you'll need a card reader to use it but for backup purposes it's perfect.
GoblinSlayer 6y ago
Have a higher security fallback.
Ciantic 6y ago
If you use GPG and YubiKey approach, you can create the keys in offline computer, store them to YubiKey, and make paper copy of the private key. Also you probably shouldn't have only single way to access the remote computer, I still intend to store password for root that I never use. I wrote about my endeavour with this approach just few days ago [1]. [1]: https://github.com/Ciantic/thoughts/blob/master/2021/yubikey-ssh.md https://github.com/Ciantic/thoughts/blob/master/2021/yubikey...
- sneak 6y ago
  You should totally disable password authentication for SSH.
  - Ciantic 6y ago
    You are right, but you can still use password for recovery purposes even if it's not used for SSH authentication. Most VPS provides "web console" access. It connects like terminal, like Digital Ocean's web-console that doesn't require SSH access [1]. [1]: https://www.digitalocean.com/docs/droplets/resources/console/ https://www.digitalocean.com/docs/droplets/resources/console...

I have one key permanently in a usb port of each computer, and one on my keychain as a backup (which is also used for U2F and has lightning so works with my phone for 2FA), so five in total, each with their own RSA key for ssh.

danielheath 6y ago

You need two; one stowed safely and only retrieved to enroll a new service, and one to use day-to-day.

sneak 6y ago
enroll a new service? we are talking about gpg smartcard usage, for ssh - not u2f 2fa. you don't need the physical key to "enroll", you just keep a copy of its pubkey.
- tmottabr 6y ago
  the idea is to generate the key in the device, so it never leave the device, therefore you cannot store it somewhere else like another device. So, the ideia is for you to have two devices, each with its own key, the first device you use daily and the second you use store in a safe location. if your first device in daily use stop working or is lost you use the second device you have stored to login to your systems to remove the keys from the lost device and add the keys for a new device that replace it and then store the second device back in a safe location.

darkr 6y ago

Then that key can no longer be used. The solution to this resulting in being permanently locked out is to have more than n+1 redundancy in hardware, and ideally meatware too.

devoutsalsa 6y ago

I'm more worried about simply losing it. I travel a lot.

GekkePrutser 6y ago
Just use multiple. That's what I do. As backup you can also use OpenPGP cards which cost much less than a yubikey. Or a cheaper Fido2 token if you use Fido2 for SSH access (I don't yet but it's coming into vogue). An OpenPGP card will cost about a tenner, you'll need a card reader to use it but for backup purposes it's perfect.

GoblinSlayer 6y ago

Have a higher security fallback.

Ciantic 6y ago

If you use GPG and YubiKey approach, you can create the keys in offline computer, store them to YubiKey, and make paper copy of the private key. Also you probably shouldn't have only single way to access the remote computer, I still intend to store password for root that I never use. I wrote about my endeavour with this approach just few days ago [1]. [1]: https://github.com/Ciantic/thoughts/blob/master/2021/yubikey-ssh.md https://github.com/Ciantic/thoughts/blob/master/2021/yubikey...

sneak 6y ago
You should totally disable password authentication for SSH.
- Ciantic 6y ago
  You are right, but you can still use password for recovery purposes even if it's not used for SSH authentication. Most VPS provides "web console" access. It connects like terminal, like Digital Ocean's web-console that doesn't require SSH access [1]. [1]: https://www.digitalocean.com/docs/droplets/resources/console/ https://www.digitalocean.com/docs/droplets/resources/console...