4 ms·

I think this is true if you only really have one or two computers you use ssh from regularly but if you have a few or you get new ones frequently you can get ba

I think this is true if you only really have one or two computers you use ssh from regularly but if you have a few or you get new ones frequently you can get back to that experience of not having to frequently generate and distribute public keys by using a yubikey to sign local keys and then your authorized_keys only needs the cert authorization in it.

NjU24E48YqdBGnG 4y ago
I just store my SSH key in my Yubikey and then I can SSH from any computer that has SSH and GPG installed. Gets rid of the "generate and sign a key that then sits on that computer that might not be fully trusted" step...
- zhfliz 4y ago
  not as flexible, as it has more dependencies, but you can make it work without gpg as well: https://developers.yubico.com/yubico-piv-tool/YKCS11/ https://developers.yubico.com/yubico-piv-tool/YKCS11/
  - NjU24E48YqdBGnG 4y ago
    Yes, I could. In fact I actually also use the PIV functionality, just not for SSH. The GPG answer seems simpler, at least for my use-case, since it really does just require SSH and GPG (okay, and GPG configured to `enable-ssh-support`). Also, I was actually using a GPG-as-SSH-key before I started hosting it on my Yubikey. Sadly, the Windows GPG build and Win32-OpenSSH don't talk to the agent the same way, so it doesn't work there. (AFAIR Windows GPG - and Putty - uses "Assuan" while Win32-OpenSSH uses named pipes just like *nix SSH/GPG do.) I don't think PIV would help that though :(
StewardMcOy 4y ago
I hadn't thought of storing the CA key on the YubiKey. That's an interesting way to go about it. Like the other reply though, I keep my private SSH key on the YubiKey, protected with both a PIN and a password. I can SSH from any computer as long as I can install gpg on it.
- stormbrew 4y ago
  Most of the time I don't really want to have my yubikey on me all the time (in particular, I no longer have need of regular keys in my day to day life so my keychain isn't as important as it once was). I'm happy enough to put a cert on a key, maybe with an expiry time, every now and then or on first use. And it means I have to care less about what agent I'm running most of the time.

NjU24E48YqdBGnG 4y ago

I just store my SSH key in my Yubikey and then I can SSH from any computer that has SSH and GPG installed. Gets rid of the "generate and sign a key that then sits on that computer that might not be fully trusted" step...

zhfliz 4y ago
not as flexible, as it has more dependencies, but you can make it work without gpg as well: https://developers.yubico.com/yubico-piv-tool/YKCS11/ https://developers.yubico.com/yubico-piv-tool/YKCS11/
- NjU24E48YqdBGnG 4y ago
  Yes, I could. In fact I actually also use the PIV functionality, just not for SSH. The GPG answer seems simpler, at least for my use-case, since it really does just require SSH and GPG (okay, and GPG configured to `enable-ssh-support`). Also, I was actually using a GPG-as-SSH-key before I started hosting it on my Yubikey. Sadly, the Windows GPG build and Win32-OpenSSH don't talk to the agent the same way, so it doesn't work there. (AFAIR Windows GPG - and Putty - uses "Assuan" while Win32-OpenSSH uses named pipes just like *nix SSH/GPG do.) I don't think PIV would help that though :(

StewardMcOy 4y ago

I hadn't thought of storing the CA key on the YubiKey. That's an interesting way to go about it. Like the other reply though, I keep my private SSH key on the YubiKey, protected with both a PIN and a password. I can SSH from any computer as long as I can install gpg on it.

stormbrew 4y ago
Most of the time I don't really want to have my yubikey on me all the time (in particular, I no longer have need of regular keys in my day to day life so my keychain isn't as important as it once was). I'm happy enough to put a cert on a key, maybe with an expiry time, every now and then or on first use. And it means I have to care less about what agent I'm running most of the time.