4 ms·
What I kinda want is a way to use a detachable hardware key like a Yubikey as a primary factor for SSH and login authentication. I have multiple computers and I
by nixpulvis 4y ago
What I kinda want is a way to use a detachable hardware key like a Yubikey as a primary factor for SSH and login authentication. I have multiple computers and I provision new OSes frequently and I always find it irritating depending on either network or flash drive synchronization for secret material when I could just be plugging in a smartcard device.
Anyone gone down this path?
- als0 4y agoYubiKey already supports those scenarios, I think.
- MadQ 4y agoThis is possible with PGP Keys stored on the Yubikey and used as the SSH keys. Check the Repo of drduh as a starting point https://github.com/drduh/YubiKey-Guide#ssh https://github.com/drduh/YubiKey-Guide#ssh
- nixpulvis 4y agoCorrect me if I'm wrong or missing something, but doesn't the use of SSH resident keys still require a file to be present on the client before it can authenticate? I'm prompted to use the SK to prove my 'presence' after the standard identity secret keyfile is checked. To be clear, my goal is to simply plug in my SK to a fresh OS install and "magically" be able to SSH into my servers.
- acdha 4y agoThat’s how it works for me. I generated a new key on the device, installed the public key where appropriate, and tap to authenticate. https://support.apple.com/en-us/HT208372 https://support.apple.com/en-us/HT208372 https://playbooks.idmanagement.gov/piv/engineer/ssh/ https://playbooks.idmanagement.gov/piv/engineer/ssh/
- trevorthejag 4y agoMaybe not “magic” but you can get very close to that with “Discoverable Credentials” on a FIDO2 key. The process for using a discoverable key on a new machine re-imports the relevant public key and private key handle to the new machine when you “ssh-keygen -K”. Its roughly equivalent to copying key material around with a flash drive, but without the need to remember two physical items.
- ratorx 4y agoGPG keys are one option, but only recommended if you need compatibility. Having to deal with GPG + GPG agent is enough to make them a pain to use. The modern way is SSH resident keys. However, this requires a “modern” SSH version (8.2), but does not add a dependency on GPG. Modern in this case, is a version from 2020.
- nixpulvis 4y agoSee my other comment for why I don't think SSH resident keys accomplish what I'm looking for. I'll have to experiment with using gpg-agent a bit, that sounds promising although potentially irritating to configure cross platform.
- ratorx 4y agoYou don’t need a file on the client for resident keys. You have to run a command to load them into the SSH agent, but you don’t need any information for that. https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...
- nixpulvis 4y agoAhhhh. The key thing I was missing was `ssh -K`. This works, but isn't really quite what I was hoping for. It's effectively using the SK as a glorified flash drive to transfer the secret key. I was kinda hoping to avoid storing the private key on the local machine at all. There are upsides to this strategy however, especially given how simple it is and how it maintains compatibility with tools which require secret key material directly. I may end up using a mix of this and a GPG integration once I learn more about how that works with SSH. I still need to dig into PIV/PAM/Keychain/FileVault/etc... Thanks for the top though :)
- ratorx 4y agoI’m not sure, but I’d be surprised if the secret key leaves the SK. If you remove it, SSH doesn’t work. `-K` configures a pointer so SSH knows where to look to find the private key (on the SK). It is the same as non-resident keys, but stores the private key pointer on the SK as well.
- mimsee 4y agoYou can use the security-key variants of ssh keys. Those would be ecdsa-sk, ed25519-sk and others[0]. This does require a newer OpenSSH version to work. GitHub has added support for these keys back in 2021. [0]: https://news.ycombinator.com/item?id=22324074 https://news.ycombinator.com/item?id=22324074 [1]: https://github.blog/2021-05-10-security-keys-supported-ssh-git-operations/ https://github.blog/2021-05-10-security-keys-supported-ssh-g...
- goodpoint 4y agoWhat real security risk is it mitigating tho?
- nixpulvis 4y agoUm... it replaces a password (or manual management of keys) with a USB device I can carry around like a proper key.
- goodpoint 4y agoYou described what it does and missed the point of my question. What real security risk is it being handled?
- Too 4y agoA hacker who got into your laptop can’t simply copy your id_rsa file to get further access to all your servers, it’s physically stored in the usb dongle with no way to get it out and requires physically touching it each time key is used.
- goodpoint 4y agoA hacker who got into your laptop can piggy back on your SSH connections (and also extract all sort of vital data). Not being able to extract SSH keys helps very little.
- smw 4y agoHelps more than you might think! Because the other thing Secretive can do is require touch ID for each use of the key. Similarly, you can require a button push from your yubikey.
- UniqueUsername0 4y agoLook up ssh -sk keys. OpenSSH has been supporting FIDO2 secured keys for quite a while now. You're specifically looking for "resident" keys.