Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

github.com

Post reply on HN
Print view View original

31–40 of 53 posts

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#31

Post by 411111111111111 »

StavrosK wrote: post #29
veeti wrote: post #28

Earlier quoted context omitted.

> The downside is that both sides have to be running SSH 8.2+. This is the problem. I was really excited for FIDO SSH keys, but LTS server distributions don't support it so it's going to take years for broad adoption.

Ubuntu LTS does support it, and it's already out. Servers are set to have the upgrade offered in a month, IIRC.

Half of our servers are Ubuntu 14.04, the rest 18.04.

I'll wager that it's not gonna be in either of these releases.

You should specify which lts you're talking about with a distribution that releases every 6 months

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#32

Post by StavrosK »

411111111111111 wrote: post #31
StavrosK wrote: post #29

Earlier quoted context omitted.

Ubuntu LTS does support it, and it's already out. Servers are set to have the upgrade offered in a month, IIRC.

Half of our servers are Ubuntu 14.04, the rest 18.04. I'll wager that it's not gonna be in either of these releases. You should specify which lts you're talking about with a distribution that releases every 6 months

It's in 20.04, the next LTS, which will be an upgrade option to you in a month.

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#33

Post by FiloSottile »

m3nu wrote: post #2

I use it with PKCS#11 mode and can't confirm some of the drawbacks the author mentions under Alternatives : > The UX of this solution is poor: [...] and needs manual reloading every time the YubiKey is unplugged or the machine goes to sleep. I never have to re-enter the PIN after sleep and can even unplug it for a while to use the port for HDMI output. Still good to see some work in this space. Native OpenSSH support…

It surely depends on the OS, and on the PKCS#11 implementation. I tested ykcs11 and OpenSC on macOS and they were like I described. I had started this project as a simple setup tool for PKCS#11 configurations and had to build the agent to get the UX I wanted.

Also, not having to re-enter the PIN after unplug means it's being cached in memory rather than on device, which I'm not a fan of. In yubikey-agent that's handled by using a graphical pinentry during operation to avoid the manual unlock step.

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#34

Post by ithkuil »

StavrosK wrote: post #27
ithkuil wrote: post #25

Earlier quoted context omitted.

Can such a key be used as an aws key?

The public key? Sure, if the AWS SSH server supports the key type.

Only RSA keys are supported by default on AWS. Surely, if you can run some arbitrary cloud-init code to initialize the instance you can install whatever is supported by the sshd in the image.

I had problems pushing for solutions that used non-RSA public keys in my $dayjob because of this

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#35

Post by xaduha »

> The UX of this solution is poor

Not surprising if you ask me, have you installed an applet for it? Do latest Yubikey even allow installing applets? Why are you using PIV for this?

I was using https://github.com/philipWendland/IsoApplet with OpenSC and smartcards since 2016, no issues.

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#36

Post by brazzy »

StavrosK wrote: post #16
brazzy wrote: post #15

Earlier quoted context omitted.

Can you register multiple devices for the same SSH key, so you have a backup in case one gets lost or breaks?

No, but why do you need to? Just add multiple keys to all hosts.

Oh right, that's effectively the same thing...

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#37

Post by fhenneke »

stavros wrote: post #14

I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out. Using a Yubikey (or any other U2F-compatible key, which is a lot of them) is a breeze: Run `ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk` to generate a key from your Yubikey and you're done. You can even use Resident Keys mode (if your key supp…

The new OpenSSH keys are very convenient if used correctly, but have a crucial disadvantage compared to the PIV-based approach of yubikey-agent: They currently can't be protected effectively with a PIN, so you should take good care of your security key or require multiple authentication methods on your server.

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#38

Post by StavrosK »

fhenneke wrote: post #37
stavros wrote: post #14

I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out. Using a Yubikey (or any other U2F-compatible key, which is a lot of them) is a breeze: Run `ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk` to generate a key from your Yubikey and you're done. You can even use Resident Keys mode (if your key supp…

The new OpenSSH keys are very convenient if used correctly, but have a crucial disadvantage compared to the PIV-based approach of yubikey-agent: They currently can't be protected effectively with a PIN, so you should take good care of your security key or require multiple authentication methods on your server.

Why can't they? Using a PIN works fine with my key.

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#39

Post by fhenneke »

StavrosK wrote: post #38
fhenneke wrote: post #37

Earlier quoted context omitted.

The new OpenSSH keys are very convenient if used correctly, but have a crucial disadvantage compared to the PIV-based approach of yubikey-agent: They currently can't be protected effectively with a PIN, so you should take good care of your security key or require multiple authentication methods on your server.

Why can't they? Using a PIN works fine with my key.

You can set a FIDO2 PIN on your security key and it will prevent ssh-keygen/ssh-add from regenerating the key files without it. But the relevant information (the key handle) can also be retrieved from the key in other ways that don't require the PIN. This is likely going to be fixed in a future version of OpenSSH, but may require a more recent kind of FIDO2 key. Until then, you should consider resident OpenSSH keys to provide only single-factor authentication ("possession"), even if a PIN is set on the security key.

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#40

Post by StavrosK »

fhenneke wrote: post #39
StavrosK wrote: post #38

Earlier quoted context omitted.

Why can't they? Using a PIN works fine with my key.

You can set a FIDO2 PIN on your security key and it will prevent ssh-keygen/ssh-add from regenerating the key files without it. But the relevant information (the key handle) can also be retrieved from the key in other ways that don't require the PIN. This is likely going to be fixed in a future version of OpenSSH, but may require a more recent kind of FIDO2 key. Until then, you should consider resident OpenSSH keys t…

Hmm, does the token provide signing without the PIN? That seems like a very big oversight, but mine doesn't sign in without the PIN.

What can someone with the handle do? They can't log in without the USB token, right?

Post reply on HN