4 ms·
And adding -O resident to the ssh-keygen command. However it is only supported on FIDO2 keys (which are spec'd to ask a PIN when using a resident key)
by loulouxiv 5y ago
And adding -O resident to the ssh-keygen command. However it is only supported on FIDO2 keys (which are spec'd to ask a PIN when using a resident key)
- danieldk 5y agoNot just FIDO2, I think you also need CTAP 2.1 for credential management/protection. E.g. my pre 5.2.3 firmware (which adds credential management) YubiKey Nano fails with: debug1: ssh_sk_enroll: /dev/hidraw0 does not support credprot, refusing to create unprotected resident/verify-required key
- StavrosK 5y agoYes, your USB key needs to have resident key support. I'm looking forward to the Solo key (which is now one or two years delayed from when it was originally supposed to come out), which will apparently support thousands of resident keys. You don't need so many for SSH, but it's great for usernameless/passwordless auth with websites.