5 ms·

You don’t need a file on the client for resident keys. You have to run a command to load them into the SSH agent, but you don’t need any information for that.

by ratorx 4y ago

You don’t need a file on the client for resident keys. You have to run a command to load them into the SSH agent, but you don’t need any information for that. https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

nixpulvis 4y ago
Ahhhh. The key thing I was missing was `ssh -K`. This works, but isn't really quite what I was hoping for. It's effectively using the SK as a glorified flash drive to transfer the secret key. I was kinda hoping to avoid storing the private key on the local machine at all. There are upsides to this strategy however, especially given how simple it is and how it maintains compatibility with tools which require secret key material directly. I may end up using a mix of this and a GPG integration once I learn more about how that works with SSH. I still need to dig into PIV/PAM/Keychain/FileVault/etc... Thanks for the top though :)
- ratorx 4y ago
  I’m not sure, but I’d be surprised if the secret key leaves the SK. If you remove it, SSH doesn’t work. `-K` configures a pointer so SSH knows where to look to find the private key (on the SK). It is the same as non-resident keys, but stores the private key pointer on the SK as well.
- TacticalCoder 4y ago
  > I was kinda hoping to avoid storing the private key on the local machine at all. I may be misunderstanding but I use U2F with OpenSSH (8.3). The private key is not on the local machine. It's still SSH public/private key pair but the private key on the computer is only a "key handle", not the real private key. The private key is protected on the security key. I don't mind copying that private key around: although it looks like a private key, it's just a key handle and not the actual private key.
  - nixpulvis 4y ago
    Good point. I'm not being precise, sorry. Still, I'm trying to avoid leaving so many breadcrumbs on my systems if they aren't needed.
    - phaer 4y ago
      Not using SSH resident keys myself yet, but you also require key identifiers for your gpg keys on the local machine if you use yubikeys with gpg afaik.
- nixpulvis 4y ago
  Ugh, now I'm having the dreaded ERROR: Failed to connect to YubiKey when running ykman fido info. :(

by ratorx 4y ago

nixpulvis 4y ago

Ahhhh. The key thing I was missing was `ssh -K`. This works, but isn't really quite what I was hoping for. It's effectively using the SK as a glorified flash drive to transfer the secret key. I was kinda hoping to avoid storing the private key on the local machine at all. There are upsides to this strategy however, especially given how simple it is and how it maintains compatibility with tools which require secret key material directly. I may end up using a mix of this and a GPG integration once I learn more about how that works with SSH. I still need to dig into PIV/PAM/Keychain/FileVault/etc... Thanks for the top though :)

ratorx 4y ago
I’m not sure, but I’d be surprised if the secret key leaves the SK. If you remove it, SSH doesn’t work. `-K` configures a pointer so SSH knows where to look to find the private key (on the SK). It is the same as non-resident keys, but stores the private key pointer on the SK as well.
TacticalCoder 4y ago
> I was kinda hoping to avoid storing the private key on the local machine at all. I may be misunderstanding but I use U2F with OpenSSH (8.3). The private key is not on the local machine. It's still SSH public/private key pair but the private key on the computer is only a "key handle", not the real private key. The private key is protected on the security key. I don't mind copying that private key around: although it looks like a private key, it's just a key handle and not the actual private key.
- nixpulvis 4y ago
  Good point. I'm not being precise, sorry. Still, I'm trying to avoid leaving so many breadcrumbs on my systems if they aren't needed.
  - phaer 4y ago
    Not using SSH resident keys myself yet, but you also require key identifiers for your gpg keys on the local machine if you use yubikeys with gpg afaik.
nixpulvis 4y ago
Ugh, now I'm having the dreaded ERROR: Failed to connect to YubiKey when running ykman fido info. :(