Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

github.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#41

Post by fhenneke »

StavrosK wrote: post #40
fhenneke wrote: post #39

Earlier quoted context omitted.

You can set a FIDO2 PIN on your security key and it will prevent ssh-keygen/ssh-add from regenerating the key files without it. But the relevant information (the key handle) can also be retrieved from the key in other ways that don't require the PIN. This is likely going to be fixed in a future version of OpenSSH, but may require a more recent kind of FIDO2 key. Until then, you should consider resident OpenSSH keys t…

Hmm, does the token provide signing without the PIN? That seems like a very big oversight, but mine doesn't sign in without the PIN. What can someone with the handle do? They can't log in without the USB token, right?

The tokens are engineered to protect the private key material stored inside them very well, so you can be quite certain that nobody will ever be able to log in without physical access to the key (to touch/press the button).

However, the SSH protocol differs quite substantially from the FIDO2/WebAuthn spec in how it uses the PIN set on the token. Depending on how the SSH server is configured and which defaults your security token's manufacturer chose, it may be the case that the PIN is not needed to log in (assuming physical access to the token).

I hope that all of this will be clarified in the OpenSSH documentation at some point as it is quite vague about security guarantees at the moment. It's probably best to use the non-resident version of the new key type together with a passphrase on the key file for now, or rely on the PIV applet instead.

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#42

Post by frutiger »

microtonal wrote: post #22
stavros wrote: post #14

I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out. Using a Yubikey (or any other U2F-compatible key, which is a lot of them) is a breeze: Run `ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk` to generate a key from your Yubikey and you're done. You can even use Resident Keys mode (if your key supp…

I use gpg-agent, but I agree it is often a pain. I will probably switch to U2F + SSH once more servers have OpenSSH 8.2. Do you know if this already works with GitHub?

> Do you know if this already works with GitHub?

It does not. From an `ssh -vvv git@github.com -i ` session:

    debug1: Next authentication method: publickey
    debug1: Offering public key:  ED25519-SK SHA256: explicit authenticator
    debug3: send packet: type 50
    debug2: we sent a publickey packet, wait for reply
    debug3: receive packet: type 51
    debug1: Authentications that can continue: publickey
Packet type 51 is SSH_MSG_USERAUTH_FAILURE (see https://www.ietf.org/rfc/rfc4250.html#section-4.1.2).

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#43

Post by jopsen »

noodlesUK wrote: post #5
jopsen wrote: post #3

Hmm, gpg-agent has worked nicely for me. The biggest pain is that I have to reconfigure when I switch yubikey. (Yes, I have multiple keys with the same gpg key on each)

Doesn’t having the same key on multiple devices kinda ruin some of the point of the yubikey? What if you wanted to revoke one after you lost it? Also, how do you store your gpg key? I have a couple yubikeys, but I have different keys on each of them, and I find that works just fine.

Keep it simple.. once the key is on an yubikey it's not going anywhere..

The biggest risk is that I loose the key.

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#44

Post by jopsen »

Boulth wrote: post #30
jopsen wrote: post #3

Hmm, gpg-agent has worked nicely for me. The biggest pain is that I have to reconfigure when I switch yubikey. (Yes, I have multiple keys with the same gpg key on each)

> The biggest pain is that I have to reconfigure when I switch yubikey. This is planned to be fixed in GnuPG 2.3.

Wow, how?

Currently I understand that gpg records a card identifier. And my card doesn't have the same id.

I suppose it'll be a long time before this hits stable distros anyways. But nice to see improvements :)

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#45

Post by StavrosK »

fhenneke wrote: post #41
StavrosK wrote: post #40

Earlier quoted context omitted.

Hmm, does the token provide signing without the PIN? That seems like a very big oversight, but mine doesn't sign in without the PIN. What can someone with the handle do? They can't log in without the USB token, right?

The tokens are engineered to protect the private key material stored inside them very well, so you can be quite certain that nobody will ever be able to log in without physical access to the key (to touch/press the button). However, the SSH protocol differs quite substantially from the FIDO2/WebAuthn spec in how it uses the PIN set on the token. Depending on how the SSH server is configured and which defaults your se…

Oh huh, that's unfortunate. I was under the impression that the Yubikey would not sign anything without a PIN, period, and that it wipes its contents after three (ten?) wrong attempts. This greatly reduces the security of the token, and it's a shame since we were so close to perfect...

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#46

Post by teruakohatu »

stavros wrote: post #14

I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out. Using a Yubikey (or any other U2F-compatible key, which is a lot of them) is a breeze: Run `ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk` to generate a key from your Yubikey and you're done. You can even use Resident Keys mode (if your key supp…

Sounds really easy but how do you backup this key to another Yubikey? Or do you simply have two, and always add two keys to each server?

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#47

Post by StavrosK »

teruakohatu wrote: post #46
stavros wrote: post #14

I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out. Using a Yubikey (or any other U2F-compatible key, which is a lot of them) is a breeze: Run `ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk` to generate a key from your Yubikey and you're done. You can even use Resident Keys mode (if your key supp…

Sounds really easy but how do you backup this key to another Yubikey? Or do you simply have two, and always add two keys to each server?

The latter, yes. That way it's trivial to revoke one if it gets lost.

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#49

Post by urza »

teruakohatu wrote: post #46
stavros wrote: post #14

I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out. Using a Yubikey (or any other U2F-compatible key, which is a lot of them) is a breeze: Run `ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk` to generate a key from your Yubikey and you're done. You can even use Resident Keys mode (if your key supp…

Sounds really easy but how do you backup this key to another Yubikey? Or do you simply have two, and always add two keys to each server?

You can also look into Trezor - it has much better backup system, among other advatages compared to yobikey

https://blog.trezor.io/openssh-with-fido2-and-trezor-e565c22...

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#50

Post by sebazzz »

m3nu wrote: post #11
abricot wrote: post #8

Is it considered good practice to create the key on the yubi and not have a backup? Or alternatively a master key to sign the key on the yubi so you can create a new subkey if you lose the yubi?

You have 2 physical Yubikeys and no backup anywhere else. One way to achieve it is by generating it on a RAM disk and throwing it away, once it's on both Yubikeys. I blogged about it here https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec... (for macOS)

Windows users might find this useful: https://github.com/drduh/YubiKey-Guide
Post reply on HN