7 ms·

Does anyone know if there is a way to have ssh just use the security key without having to have the key files on disk? I work from several computers and VMs. I

Does anyone know if there is a way to have ssh just use the security key without having to have the key files on disk? I work from several computers and VMs. It is somewhat of a pain to have to generate and register keys for each computer and VM. It would be nice if I could just generate the ssh key once on my security key and use that everywhere.

OminousWeapons 5y ago
https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide
kiallmacinnes 5y ago
Yes, you can use gpg-agent to handle this - I've been doing it for years... Every machine does need to be setup to use gpg-agent in place of ssh-agent, which frankly is a little annoying - but once it's setup your key is entirely on the YubiKey or similar. Here's[1] the first blog I could find that at a glance appears to provide the right instructions. [1]: https://evilmartians.com/chronicles/stick-with-security-yubikey-ssh-gnupg-macos https://evilmartians.com/chronicles/stick-with-security-yubi...
- Firehawke 5y ago
  My experience is that the initial setup with gpg-agent is a massive pain, especially on Windows+WSL2 setups, but once you get it working it's great. Well, except when gpg-agent dies out of nowhere and you have to restart it.. It's still better security even if it doesn't go quite as smoothly as I'd hope. A tip to anyone else here who wants to do this: You want gpg-agent, and you absolutely need to use a newer build of OpenSSH than the one that ships with Windows 10 currently. Remove that and go find the official distribution on GitHub or Chcoolatey so you have a version that supports that key type. Then you also need to make sure to set up the environment variable GIT_SSH to point to that version of OpenSSH or else Git for Windows will try to use its own older build and then you will spend a week trying to figure out how to make it work.
StavrosK 5y ago
Yes, it's easy, you don't need gpg-agent or anything, just do `ssh-add -K`: https://www.stavros.io/posts/u2f-fido2-with-ssh/ https://www.stavros.io/posts/u2f-fido2-with-ssh/
- allset_ 5y ago
  You do need a fairly recent version of OpenSSH though.
  - StavrosK 5y ago
    That's true, but it's old enough that you'll probably have it, and I think that's the only way that'll work with this Github feature, since it's U2F support they're adding.
- RcouF1uZ4gsC 5y ago
  This was exactly what I was looking for
- OJFord 5y ago
  Does this work with existing keys, including ones generated on the device? (as distinct from 'resident' here which seems to generate on computer and copy to device, anything else special?) Basically wondering if I can drop gpg-agent (for SSH auth purposes anyway) and 'sshcontrol' without changing key.
  - StavrosK 5y ago
    No, if you don't use resident keys you need the files (as the keys need to come from somewhere). The keys aren't copied to the device, they're generated on the device, more or less.
    - OJFord 5y ago
      > No, if you don't use resident keys you need the files (as the keys need to come from somewhere). Right, but I already have it on the device, I'm talking about using an already provisioned device with this new-ish OpenSSH feature; or whether it does something 'special' that means the key needs to be ('resident' or not) generated by this feature? Thinking about it though it's probably not for me, since SSH is not the only and probably the minority of my use, since I also use the encryption key (e.g. with `pass`) and signing (e.g. git commits, for no particular reason). > The keys aren't copied to the device, they're generated on the device, more or less. In your blog post you say it produces two files, the private and public keys. If it generated on device it wouldn't (be able to) have the private key?
michaelt 5y ago
Some security keys implement multiple standards, others don't. A $25 blue Yubikey only supports U2F, which requires at least OpenSSH 8.2 on the host you're connecting to. U2F is the standard used for logging into websites with a security key, and there are many vendors other than yubikey. A $45 black Yubikey 5 also supports OpenPGP and Smart Card/PIV which can do SSH without server updates (with a bit of software installation on your end).
- _trampeltier 5y ago
  Even I have and I use a Yubikey 5, the whole thing still feels a bit like a black box for me. I still have not found a good overview about the different standarts, what do they different and about the many options in the Yubikey software. Also I kind of get, you can't make a backup key. But in the end, if they key is lost, you use also mostly just another password again. But for me, I would much prefer to create a second key somehow.
  - deadbunny 5y ago
    You can create a key and load it into the Yubikey (and thus backup the key) rather than have the yubikey create the key on itself directly.
    - tialaramex 5y ago
      You can't do this with the key underlying FIDO (thus U2F/ WebAuthn and the SSH feature the linked article is discussing) Yubico supply a tool that lets you perform a "factory reset" giving you a random key (effectively: instantly invalidating all credentials you previously used) but not one that would let you pick the key. IIRC The relevant standard is clear that manufacturers should not offer this capability as it's obvious how it would get exploited.
  - loulouxiv 5y ago
    I felt the same at first when I received mine. And since the information is quite scattered in Yubico's documentation, blog and on external websites it was very time consuming to figure everything out... It also seems that a lot of things have evolved in this area so it is not easy to know what is still useful/the best way to do things. When I get the time to, I want to put up a webpage that explains the main state-of-the-art usages of the Yubikey, with step by step instructions for the major platforms
unixhero 5y ago
Do you mean the TPM hardware Key?
bennyp101 5y ago
Yep, I followed the guide here: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide Means I can SSH into any box that has that key on it, or push/pull repos from anywhere as long as I have a yubikey with me. I also used https://www.jabberwocky.com/software/paperkey/ https://www.jabberwocky.com/software/paperkey/ to make a backup, and have that and a spare yubikey stored elsewhere securely. (You can create the key on the yubikey directly, but then I think it's not possible to have a backup yubikey)
teekert 5y ago
https://www.akamai.com/us/en/products/security/akamai-mfa.jsp https://www.akamai.com/us/en/products/security/akamai-mfa.js... ?
lxgr 5y ago
Besides all the suggestions for GnuPG/OpenPGP-based SSH keys, there's also "-O resident" for FIDO2-based keys. This also stores the private key on the security key itself, removing the need for the key handle file. For more details, see the release notes for FIDO2 on OpenSSH: https://www.openssh.com/txt/release-8.2 https://www.openssh.com/txt/release-8.2
arianvanp 5y ago
Yes; See the tutorial on Resident keys here: https://www.yubico.com/blog/github-now-supports-ssh-security-keys/ https://www.yubico.com/blog/github-now-supports-ssh-security... With resident keys you can load the ssh key description from the key directly into the ssh-agent. $ ssh-keygen -t ecdsa-sk -O resident $ ssh-add -K $ ssh git@github.com
brnt 5y ago
I have my private key in a Keepass database, and with a keypress Keepass(XC) loads it into my agent. After a time that you specify, it unloads it automatically. I use a U2F key now, and that key I just have in ~/.ssh. It's useless without my U2F fob anyway. (Right?)
- tialaramex 5y ago
  Yes, you are correct that it is useless without your physical Security Key. Technically what's happening is that the valuable private key is in a sense in that file you're not worried about. But, you're safe not worrying about it, because it was encrypted by the Security Key, and only the Security Key knows how to decrypt it, so even though in one sense it's the private key and very important, because it's encrypted it's not a big deal if anybody learns it, as they couldn't possibly decrypt it. The contents of the file are given back to the Security Key when you use SSH to connect to (say) GitHub and in fact it will decrypt them to discover your private key, then use it, and then forget it again immediately, but it could (hypothetically) instead store a library of all credentials and use the random contents of the file to just look up the right credentials in the huge library. That would cost $$$ and Security Keys are (relatively) cheap. It's OK to completely forget that technical description, the designers of Security Keys specifically intended that you needn't care how the magic is done, I have explained it only to reassure anyone puzzling how this could possibly work.

OminousWeapons 5y ago

https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide

kiallmacinnes 5y ago

Yes, you can use gpg-agent to handle this - I've been doing it for years... Every machine does need to be setup to use gpg-agent in place of ssh-agent, which frankly is a little annoying - but once it's setup your key is entirely on the YubiKey or similar. Here's[1] the first blog I could find that at a glance appears to provide the right instructions. [1]: https://evilmartians.com/chronicles/stick-with-security-yubikey-ssh-gnupg-macos https://evilmartians.com/chronicles/stick-with-security-yubi...

Firehawke 5y ago
My experience is that the initial setup with gpg-agent is a massive pain, especially on Windows+WSL2 setups, but once you get it working it's great. Well, except when gpg-agent dies out of nowhere and you have to restart it.. It's still better security even if it doesn't go quite as smoothly as I'd hope. A tip to anyone else here who wants to do this: You want gpg-agent, and you absolutely need to use a newer build of OpenSSH than the one that ships with Windows 10 currently. Remove that and go find the official distribution on GitHub or Chcoolatey so you have a version that supports that key type. Then you also need to make sure to set up the environment variable GIT_SSH to point to that version of OpenSSH or else Git for Windows will try to use its own older build and then you will spend a week trying to figure out how to make it work.

StavrosK 5y ago

Yes, it's easy, you don't need gpg-agent or anything, just do `ssh-add -K`: https://www.stavros.io/posts/u2f-fido2-with-ssh/ https://www.stavros.io/posts/u2f-fido2-with-ssh/

allset_ 5y ago
You do need a fairly recent version of OpenSSH though.
- StavrosK 5y ago
  That's true, but it's old enough that you'll probably have it, and I think that's the only way that'll work with this Github feature, since it's U2F support they're adding.
RcouF1uZ4gsC 5y ago
This was exactly what I was looking for
OJFord 5y ago
Does this work with existing keys, including ones generated on the device? (as distinct from 'resident' here which seems to generate on computer and copy to device, anything else special?) Basically wondering if I can drop gpg-agent (for SSH auth purposes anyway) and 'sshcontrol' without changing key.
- StavrosK 5y ago
  No, if you don't use resident keys you need the files (as the keys need to come from somewhere). The keys aren't copied to the device, they're generated on the device, more or less.
  - OJFord 5y ago
    > No, if you don't use resident keys you need the files (as the keys need to come from somewhere). Right, but I already have it on the device, I'm talking about using an already provisioned device with this new-ish OpenSSH feature; or whether it does something 'special' that means the key needs to be ('resident' or not) generated by this feature? Thinking about it though it's probably not for me, since SSH is not the only and probably the minority of my use, since I also use the encryption key (e.g. with `pass`) and signing (e.g. git commits, for no particular reason). > The keys aren't copied to the device, they're generated on the device, more or less. In your blog post you say it produces two files, the private and public keys. If it generated on device it wouldn't (be able to) have the private key?

michaelt 5y ago

Some security keys implement multiple standards, others don't. A $25 blue Yubikey only supports U2F, which requires at least OpenSSH 8.2 on the host you're connecting to. U2F is the standard used for logging into websites with a security key, and there are many vendors other than yubikey. A $45 black Yubikey 5 also supports OpenPGP and Smart Card/PIV which can do SSH without server updates (with a bit of software installation on your end).

_trampeltier 5y ago
Even I have and I use a Yubikey 5, the whole thing still feels a bit like a black box for me. I still have not found a good overview about the different standarts, what do they different and about the many options in the Yubikey software. Also I kind of get, you can't make a backup key. But in the end, if they key is lost, you use also mostly just another password again. But for me, I would much prefer to create a second key somehow.
- deadbunny 5y ago
  You can create a key and load it into the Yubikey (and thus backup the key) rather than have the yubikey create the key on itself directly.
  - tialaramex 5y ago
    You can't do this with the key underlying FIDO (thus U2F/ WebAuthn and the SSH feature the linked article is discussing) Yubico supply a tool that lets you perform a "factory reset" giving you a random key (effectively: instantly invalidating all credentials you previously used) but not one that would let you pick the key. IIRC The relevant standard is clear that manufacturers should not offer this capability as it's obvious how it would get exploited.
- loulouxiv 5y ago
  I felt the same at first when I received mine. And since the information is quite scattered in Yubico's documentation, blog and on external websites it was very time consuming to figure everything out... It also seems that a lot of things have evolved in this area so it is not easy to know what is still useful/the best way to do things. When I get the time to, I want to put up a webpage that explains the main state-of-the-art usages of the Yubikey, with step by step instructions for the major platforms

unixhero 5y ago

Do you mean the TPM hardware Key?

bennyp101 5y ago

Yep, I followed the guide here: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide Means I can SSH into any box that has that key on it, or push/pull repos from anywhere as long as I have a yubikey with me. I also used https://www.jabberwocky.com/software/paperkey/ https://www.jabberwocky.com/software/paperkey/ to make a backup, and have that and a spare yubikey stored elsewhere securely. (You can create the key on the yubikey directly, but then I think it's not possible to have a backup yubikey)

teekert 5y ago

https://www.akamai.com/us/en/products/security/akamai-mfa.jsp https://www.akamai.com/us/en/products/security/akamai-mfa.js... ?

lxgr 5y ago

Besides all the suggestions for GnuPG/OpenPGP-based SSH keys, there's also "-O resident" for FIDO2-based keys. This also stores the private key on the security key itself, removing the need for the key handle file. For more details, see the release notes for FIDO2 on OpenSSH: https://www.openssh.com/txt/release-8.2 https://www.openssh.com/txt/release-8.2

arianvanp 5y ago

Yes; See the tutorial on Resident keys here: https://www.yubico.com/blog/github-now-supports-ssh-security-keys/ https://www.yubico.com/blog/github-now-supports-ssh-security... With resident keys you can load the ssh key description from the key directly into the ssh-agent. $ ssh-keygen -t ecdsa-sk -O resident $ ssh-add -K $ ssh git@github.com

brnt 5y ago

I have my private key in a Keepass database, and with a keypress Keepass(XC) loads it into my agent. After a time that you specify, it unloads it automatically. I use a U2F key now, and that key I just have in ~/.ssh. It's useless without my U2F fob anyway. (Right?)

tialaramex 5y ago
Yes, you are correct that it is useless without your physical Security Key. Technically what's happening is that the valuable private key is in a sense in that file you're not worried about. But, you're safe not worrying about it, because it was encrypted by the Security Key, and only the Security Key knows how to decrypt it, so even though in one sense it's the private key and very important, because it's encrypted it's not a big deal if anybody learns it, as they couldn't possibly decrypt it. The contents of the file are given back to the Security Key when you use SSH to connect to (say) GitHub and in fact it will decrypt them to discover your private key, then use it, and then forget it again immediately, but it could (hypothetically) instead store a library of all credentials and use the random contents of the file to just look up the right credentials in the huge library. That would cost $$$ and Security Keys are (relatively) cheap. It's OK to completely forget that technical description, the designers of Security Keys specifically intended that you needn't care how the magic is done, I have explained it only to reassure anyone puzzling how this could possibly work.