10 ms·

GPG keys are one option, but only recommended if you need compatibility. Having to deal with GPG + GPG agent is enough to make them a pain to use. The modern w

by ratorx 4y ago

GPG keys are one option, but only recommended if you need compatibility. Having to deal with GPG + GPG agent is enough to make them a pain to use. The modern way is SSH resident keys. However, this requires a “modern” SSH version (8.2), but does not add a dependency on GPG. Modern in this case, is a version from 2020.

nixpulvis 4y ago
See my other comment for why I don't think SSH resident keys accomplish what I'm looking for. I'll have to experiment with using gpg-agent a bit, that sounds promising although potentially irritating to configure cross platform.
- ratorx 4y ago
  You don’t need a file on the client for resident keys. You have to run a command to load them into the SSH agent, but you don’t need any information for that. https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...
  - nixpulvis 4y ago
    Ahhhh. The key thing I was missing was `ssh -K`. This works, but isn't really quite what I was hoping for. It's effectively using the SK as a glorified flash drive to transfer the secret key. I was kinda hoping to avoid storing the private key on the local machine at all. There are upsides to this strategy however, especially given how simple it is and how it maintains compatibility with tools which require secret key material directly. I may end up using a mix of this and a GPG integration once I learn more about how that works with SSH. I still need to dig into PIV/PAM/Keychain/FileVault/etc... Thanks for the top though :)
    - ratorx 4y ago
      I’m not sure, but I’d be surprised if the secret key leaves the SK. If you remove it, SSH doesn’t work. `-K` configures a pointer so SSH knows where to look to find the private key (on the SK). It is the same as non-resident keys, but stores the private key pointer on the SK as well.
    - TacticalCoder 4y ago
      > I was kinda hoping to avoid storing the private key on the local machine at all. I may be misunderstanding but I use U2F with OpenSSH (8.3). The private key is not on the local machine. It's still SSH public/private key pair but the private key on the computer is only a "key handle", not the real private key. The private key is protected on the security key. I don't mind copying that private key around: although it looks like a private key, it's just a key handle and not the actual private key.
      - nixpulvis 4y ago
        Good point. I'm not being precise, sorry. Still, I'm trying to avoid leaving so many breadcrumbs on my systems if they aren't needed.
        phaer 4y ago
        Not using SSH resident keys myself yet, but you also require key identifiers for your gpg keys on the local machine if you use yubikeys with gpg afaik.
    - nixpulvis 4y ago
      Ugh, now I'm having the dreaded ERROR: Failed to connect to YubiKey when running ykman fido info. :(
zikduruqe 4y ago
Of all the tech stacks that I have to deal with on a daily basis, I just don't get how GPG is hard. It is just like any other tool. But, I just copy my ~/.gnupg directory to my new machine or to some backup server and all my gpg backed ssh keys/configs are portable. It's not terribly hard.
- ratorx 4y ago
  IMO, GPG has a pretty terrible CLI. GPG agent config is complicated and is more of a pain to get working with forwarding etc. I don’t like the fact that GPG requires config at all. I also have no use for it, that I can’t solve with something nicer. I use age/sops for my encryption-related use cases. If I needed signing, I’d probably use minisign or signify. For authentication, Wireguard/SSH. But for the SSH key use case, none of this matters. Unless you need compatibility with old SSH servers/clients, resident keys are substantially simpler, because they cut out 1 tool entirely and don’t require copying any directories to other machines.
  - zikduruqe 4y ago
    I get it. The man pages for GPG are like reading War And Peace, whereas the man pages for Age is easily digestible. I too use Age for certain things, but have to use GPG in some of my workflows. But I find it no harder than some insane Helm chart values.yaml files, or some crazy assed Terraform runs with a tfvars file that has hundreds of lines to merely spin up a bucket or vpc. It's just another tool that you need to config and understand. > But for the SSH key use case, none of this matters. Agreed.

by ratorx 4y ago

nixpulvis 4y ago

See my other comment for why I don't think SSH resident keys accomplish what I'm looking for. I'll have to experiment with using gpg-agent a bit, that sounds promising although potentially irritating to configure cross platform.

ratorx 4y ago
You don’t need a file on the client for resident keys. You have to run a command to load them into the SSH agent, but you don’t need any information for that. https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...
- nixpulvis 4y ago
  Ahhhh. The key thing I was missing was `ssh -K`. This works, but isn't really quite what I was hoping for. It's effectively using the SK as a glorified flash drive to transfer the secret key. I was kinda hoping to avoid storing the private key on the local machine at all. There are upsides to this strategy however, especially given how simple it is and how it maintains compatibility with tools which require secret key material directly. I may end up using a mix of this and a GPG integration once I learn more about how that works with SSH. I still need to dig into PIV/PAM/Keychain/FileVault/etc... Thanks for the top though :)
  - ratorx 4y ago
    I’m not sure, but I’d be surprised if the secret key leaves the SK. If you remove it, SSH doesn’t work. `-K` configures a pointer so SSH knows where to look to find the private key (on the SK). It is the same as non-resident keys, but stores the private key pointer on the SK as well.
  - TacticalCoder 4y ago
    > I was kinda hoping to avoid storing the private key on the local machine at all. I may be misunderstanding but I use U2F with OpenSSH (8.3). The private key is not on the local machine. It's still SSH public/private key pair but the private key on the computer is only a "key handle", not the real private key. The private key is protected on the security key. I don't mind copying that private key around: although it looks like a private key, it's just a key handle and not the actual private key.
    - nixpulvis 4y ago
      Good point. I'm not being precise, sorry. Still, I'm trying to avoid leaving so many breadcrumbs on my systems if they aren't needed.
      - phaer 4y ago
        Not using SSH resident keys myself yet, but you also require key identifiers for your gpg keys on the local machine if you use yubikeys with gpg afaik.
  - nixpulvis 4y ago
    Ugh, now I'm having the dreaded ERROR: Failed to connect to YubiKey when running ykman fido info. :(

zikduruqe 4y ago

Of all the tech stacks that I have to deal with on a daily basis, I just don't get how GPG is hard. It is just like any other tool. But, I just copy my ~/.gnupg directory to my new machine or to some backup server and all my gpg backed ssh keys/configs are portable. It's not terribly hard.

ratorx 4y ago
IMO, GPG has a pretty terrible CLI. GPG agent config is complicated and is more of a pain to get working with forwarding etc. I don’t like the fact that GPG requires config at all. I also have no use for it, that I can’t solve with something nicer. I use age/sops for my encryption-related use cases. If I needed signing, I’d probably use minisign or signify. For authentication, Wireguard/SSH. But for the SSH key use case, none of this matters. Unless you need compatibility with old SSH servers/clients, resident keys are substantially simpler, because they cut out 1 tool entirely and don’t require copying any directories to other machines.
- zikduruqe 4y ago
  I get it. The man pages for GPG are like reading War And Peace, whereas the man pages for Age is easily digestible. I too use Age for certain things, but have to use GPG in some of my workflows. But I find it no harder than some insane Helm chart values.yaml files, or some crazy assed Terraform runs with a tfvars file that has hundreds of lines to merely spin up a bucket or vpc. It's just another tool that you need to config and understand. > But for the SSH key use case, none of this matters. Agreed.