4 ms·

I'd love the writeup if you get the chance, I've looked at various places on how to do it (my brother bought me a Yubikey for Christmas) but like you said, it s

by girvo 12y ago

I'd love the writeup if you get the chance, I've looked at various places on how to do it (my brother bought me a Yubikey for Christmas) but like you said, it seems more complex than it should be. I'm interested to see how it'll go with OS X.

Florin_Andrei 12y ago
Generate public/private key pair on the NEO smartcard: Run 'gpg --card-edit' In the menu, choose 'admin'. Then choose 'generate'. Then 'quit'. That's it. The private SSH key will remain on the smartcard forever; it will never leave it, not even during authentication. It cannot be extracted (well, maybe the NSA can, who knows). To extract the public SSH key from the card, run 'ssh-add -L > my-public-key.pub' You may want to edit the name (the third field) at the end of the key. I'm 99% sure ssh-add -L works on any Unix system, you don't need anything preconfigured, just plug the token into it and run the command. This way you can easily get your public key no matter where you are. The smartcard has a user PIN and an admin PIN. The default user PIN is '123456'. The default admin PIN is '12345678'. It is recommended to change them. After 3 mistakes entering the user PIN, the card locks up and you'll need to unlock it with the admin PIN. After 3 mistakes entering the admin PIN, the card is dead forever. Be careful with the PINs. Read "man gpg", options --card-edit, --card-status, and --change-pin. You will have to enter the user PIN when you authenticate SSH. It's cached for a while (see below). ######################### Configure Linux or OS X to use ssh key authentication with the NEO: Install gnupg, either from Homebrew or from GPG Tools (on OS X), or via repos on Linux. https://gpgtools.org/ https://gpgtools.org/ Configure gpg-agent: $ cat ~/.gnupg/gpg-agent.conf pinentry-program /usr/local/MacGPG2/libexec/pinentry-mac.app/Contents/MacOS/pinentry-mac enable-ssh-support write-env-file use-standard-socket default-cache-ttl 600 max-cache-ttl 7200 On Linux, I think you don't need the pinentry-program line, so remove it (not sure). Or experiment with various pinentry utilities, see what works for you; there should be a pinentry somewhere on your system after you install gnupg, and usually it's text-mode. The value shown above is for OS X with GPG Tools, which is a GUI mode pinentry. If you install gnupg via Homebrew, read what I said above about Linux. Or google for the GUI mode pinentry for OS X - it's a separate download, made from an older GPG Tools version, that you can install along with Homebrew gnupg. $ tail -n 7 .bash_profile GPG_TTY=$(tty) export GPG_TTY if [ -f "${HOME}/.gpg-agent-info" ]; then . "${HOME}/.gpg-agent-info" export GPG_AGENT_INFO export SSH_AUTH_SOCK fi The GPG_TTY is not needed with the GUI pinentry that comes with GPG Tools on OS X, but might be needed for the simpler text-mode pinentries that come with other gnupg distros. On Linux, or on Mac with gnupg installed from Homebrew, you need to launch gpg-agent upon logging in (GPG Tools will do that automatically for you). One way that seems to work well (checked with Homebrew gnupg on OS X, and with the Linux gnupg) is to add this to .bash_profile: eval $(gpg-agent --daemon) To use it, put your public key on a server, plug the NEO into USB, and run 'ssh user@host'. pinentry will ask you for the user PIN. And that's it. ########################## WARNING: PCSC is broken on OS X 10.10. If you're on 10.9, stay there if you plan to use the NEO (or any smartcard for that matter). More details here: http://support.gpgtools.org/discussions/problems/30646-gpg-agent-gets-stuck-when-used-with-smartcards-in-ssh-agent-mode http://support.gpgtools.org/discussions/problems/30646-gpg-a... You can use it on 10.10, but once in a while gpg-agent gets stuck and you'll have to kill/restart it. I've posted a script on that support forum. Works great on 10.9 and Linux.
- newman314 12y ago
  Thanks for this. Will investigate getting a Yubikey now.
- girvo 12y ago
  Brilliant, thank you so much for this. I'm looking forward to having everything on my Yubikey!
Florin_Andrei 12y ago
http://florin.myip.org/blog/easy-multifactor-authentication-ssh-using-yubikey-neo-tokens http://florin.myip.org/blog/easy-multifactor-authentication-...

by girvo 12y ago

Florin_Andrei 12y ago

Generate public/private key pair on the NEO smartcard: Run 'gpg --card-edit' In the menu, choose 'admin'. Then choose 'generate'. Then 'quit'. That's it. The private SSH key will remain on the smartcard forever; it will never leave it, not even during authentication. It cannot be extracted (well, maybe the NSA can, who knows). To extract the public SSH key from the card, run 'ssh-add -L > my-public-key.pub' You may want to edit the name (the third field) at the end of the key. I'm 99% sure ssh-add -L works on any Unix system, you don't need anything preconfigured, just plug the token into it and run the command. This way you can easily get your public key no matter where you are. The smartcard has a user PIN and an admin PIN. The default user PIN is '123456'. The default admin PIN is '12345678'. It is recommended to change them. After 3 mistakes entering the user PIN, the card locks up and you'll need to unlock it with the admin PIN. After 3 mistakes entering the admin PIN, the card is dead forever. Be careful with the PINs. Read "man gpg", options --card-edit, --card-status, and --change-pin. You will have to enter the user PIN when you authenticate SSH. It's cached for a while (see below). ######################### Configure Linux or OS X to use ssh key authentication with the NEO: Install gnupg, either from Homebrew or from GPG Tools (on OS X), or via repos on Linux. https://gpgtools.org/ https://gpgtools.org/ Configure gpg-agent: $ cat ~/.gnupg/gpg-agent.conf pinentry-program /usr/local/MacGPG2/libexec/pinentry-mac.app/Contents/MacOS/pinentry-mac enable-ssh-support write-env-file use-standard-socket default-cache-ttl 600 max-cache-ttl 7200 On Linux, I think you don't need the pinentry-program line, so remove it (not sure). Or experiment with various pinentry utilities, see what works for you; there should be a pinentry somewhere on your system after you install gnupg, and usually it's text-mode. The value shown above is for OS X with GPG Tools, which is a GUI mode pinentry. If you install gnupg via Homebrew, read what I said above about Linux. Or google for the GUI mode pinentry for OS X - it's a separate download, made from an older GPG Tools version, that you can install along with Homebrew gnupg. $ tail -n 7 .bash_profile GPG_TTY=$(tty) export GPG_TTY if [ -f "${HOME}/.gpg-agent-info" ]; then . "${HOME}/.gpg-agent-info" export GPG_AGENT_INFO export SSH_AUTH_SOCK fi The GPG_TTY is not needed with the GUI pinentry that comes with GPG Tools on OS X, but might be needed for the simpler text-mode pinentries that come with other gnupg distros. On Linux, or on Mac with gnupg installed from Homebrew, you need to launch gpg-agent upon logging in (GPG Tools will do that automatically for you). One way that seems to work well (checked with Homebrew gnupg on OS X, and with the Linux gnupg) is to add this to .bash_profile: eval $(gpg-agent --daemon) To use it, put your public key on a server, plug the NEO into USB, and run 'ssh user@host'. pinentry will ask you for the user PIN. And that's it. ########################## WARNING: PCSC is broken on OS X 10.10. If you're on 10.9, stay there if you plan to use the NEO (or any smartcard for that matter). More details here: http://support.gpgtools.org/discussions/problems/30646-gpg-agent-gets-stuck-when-used-with-smartcards-in-ssh-agent-mode http://support.gpgtools.org/discussions/problems/30646-gpg-a... You can use it on 10.10, but once in a while gpg-agent gets stuck and you'll have to kill/restart it. I've posted a script on that support forum. Works great on 10.9 and Linux.

newman314 12y ago
Thanks for this. Will investigate getting a Yubikey now.
girvo 12y ago
Brilliant, thank you so much for this. I'm looking forward to having everything on my Yubikey!

Florin_Andrei 12y ago

http://florin.myip.org/blog/easy-multifactor-authentication-ssh-using-yubikey-neo-tokens http://florin.myip.org/blog/easy-multifactor-authentication-...