4 ms·

I've used public-key basically forever. I have wanted to go that step further and implement certificates for a good few years now, I absolutely see the value,

I've used public-key basically forever. I have wanted to go that step further and implement certificates for a good few years now, I absolutely see the value, no question about it (i.e. no more out of date authorized_keys files, no need to even install authorized_keys files in the first place, the list goes on). I wish YubiKeys were more flexible in allowing SSH certificates to be hosted on them (currently can only host X509 type). Because if I could use a Yubi for SSH certificate signing I would have already been using certificates ! (Yes I know, theoretically you can do it with GPG keys, but frankly that's a PITA with many issues). My current plan is to take inspiration from this : https://smallstep.com/blog/diy-single-sign-on-for-ssh/ https://smallstep.com/blog/diy-single-sign-on-for-ssh/

jeroenhd 4y ago
You can use this great-but-also-terrible system to do X509 certificate validation with SSH: https://github.com/mjg59/ssh_pki https://github.com/mjg59/ssh_pki Maybe after some deeper security analysis this idea could help you work around the limitations of Yubikey's hardware. However, if the author of a piece of security software tells me something is a bad idea, I tend to accept that, especially if that author is mjg59.
- traceroute66 4y ago
  @jeroenhd Mea-culpa, had a choice of two smallstep bookmarks and I copy/pasted the wrong one ! Now corrected.
XiS 4y ago
As an alternative, you might consider using an ed25519-sk ssh key so you can use your YubiKey as a second factor during authentication. I've got my keys loaded up in the SSH agent by KeepassXC when I open my database and can log in to a box just by pressing my YubiKey. No keys on disk, no passwords to remember (except your Keepass master key ofcourse).
- tomaslaureano 4y ago
  Would love to know more about this workflow!
  - XiS 4y ago
    It's pretty much a combination the following: - https://keepassxc.org/docs/#faq-ssh-agent-how https://keepassxc.org/docs/#faq-ssh-agent-how - https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht... You could probably also put the SSH key itself as a resident key on the YubiKey. But personally I like the fact the key and 2FA aren't on the same device (and the fact you can only get my key when you know the KeepassXC master password).
arccy 4y ago
using yubikeys in fido2 as the CA key just works, and the cert is its public key what doesn't work is storing the signed certificates
tomatocracy 4y ago
The Yubikey PIV/X509 applet can be used for SSH (see [0]). Their link doesn't explain this but that key can be used as a CA instead of as a straight SSH key if you want. eg to add the CA to your authorized_keys files, generate a throwaway key, sign that with the CA and add it to your ssh-agent: ssh-keygen -D opensc-pkcs11.so -e > cert-on-piv.ssh ( echo -n "cert-authority "; cat cert-on-piv.ssh ) >> ~/.ssh/authorized_keys name="temp-$(date +%Y%m%d-%H%M)" ssh-keygen -q -N '' -C "${name}" -t rsa-sha2-256 -f ${name} ssh-keygen -t rsa-sha2-256 -s cert-on-piv.ssh -D opensc-pkcs11.so -V -1d:+1d -I ${name} ${name}.pub ssh-add -t 1d ${name} rm -f ${name} ${name}.pub ${name}-cert.pub [0] https://developers.yubico.com/PIV/Guides/PIV_Walk-Through.html https://developers.yubico.com/PIV/Guides/PIV_Walk-Through.ht...
djmdjm 4y ago
You can sign yubikey-hosted FIDO keys in OpenSSH just fine. A FIDO token can also act as CA, though the certificates it issues will be limited to use by relatively recent SSH versions as FIDO support was only added in 2019.

jeroenhd 4y ago

You can use this great-but-also-terrible system to do X509 certificate validation with SSH: https://github.com/mjg59/ssh_pki https://github.com/mjg59/ssh_pki Maybe after some deeper security analysis this idea could help you work around the limitations of Yubikey's hardware. However, if the author of a piece of security software tells me something is a bad idea, I tend to accept that, especially if that author is mjg59.

traceroute66 4y ago
@jeroenhd Mea-culpa, had a choice of two smallstep bookmarks and I copy/pasted the wrong one ! Now corrected.

XiS 4y ago

As an alternative, you might consider using an ed25519-sk ssh key so you can use your YubiKey as a second factor during authentication. I've got my keys loaded up in the SSH agent by KeepassXC when I open my database and can log in to a box just by pressing my YubiKey. No keys on disk, no passwords to remember (except your Keepass master key ofcourse).

tomaslaureano 4y ago
Would love to know more about this workflow!
- XiS 4y ago
  It's pretty much a combination the following: - https://keepassxc.org/docs/#faq-ssh-agent-how https://keepassxc.org/docs/#faq-ssh-agent-how - https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht... You could probably also put the SSH key itself as a resident key on the YubiKey. But personally I like the fact the key and 2FA aren't on the same device (and the fact you can only get my key when you know the KeepassXC master password).

arccy 4y ago

using yubikeys in fido2 as the CA key just works, and the cert is its public key what doesn't work is storing the signed certificates

tomatocracy 4y ago

The Yubikey PIV/X509 applet can be used for SSH (see [0]). Their link doesn't explain this but that key can be used as a CA instead of as a straight SSH key if you want. eg to add the CA to your authorized_keys files, generate a throwaway key, sign that with the CA and add it to your ssh-agent: ssh-keygen -D opensc-pkcs11.so -e > cert-on-piv.ssh ( echo -n "cert-authority "; cat cert-on-piv.ssh ) >> ~/.ssh/authorized_keys name="temp-$(date +%Y%m%d-%H%M)" ssh-keygen -q -N '' -C "${name}" -t rsa-sha2-256 -f ${name} ssh-keygen -t rsa-sha2-256 -s cert-on-piv.ssh -D opensc-pkcs11.so -V -1d:+1d -I ${name} ${name}.pub ssh-add -t 1d ${name} rm -f ${name} ${name}.pub ${name}-cert.pub [0] https://developers.yubico.com/PIV/Guides/PIV_Walk-Through.html https://developers.yubico.com/PIV/Guides/PIV_Walk-Through.ht...

djmdjm 4y ago

You can sign yubikey-hosted FIDO keys in OpenSSH just fine. A FIDO token can also act as CA, though the certificates it issues will be limited to use by relatively recent SSH versions as FIDO support was only added in 2019.