Is the Nitrokey supported? I didn't see it.
U2F Support in OpenSSH Head
11–20 of 22 posts
Re: U2F Support in OpenSSH Head
#12You can use U2F with SSH today by making U2F a pam authentication requirement... though this normally requires some copy and paste of the u2f challenge and response since your terminal doesn't know to do that and the ssh client software itself doesn't recognize the U2F challenge. Making it easier would be really nice. The linked post really unclear to me about the security properties provided. This document ( https:/…
> If the goal wasn't to require the key file-- why store the key handle there at all and not just derive it from data sent by the server as in a more typical U2F application? The only other advantage I see is potentially limiting some cros-domain attacks (e.g. where server A provides server B's key handle). I was also a little surprised this isn't used as a second factor, like Universal 2nd Factor is meant to be used…
You can use it as a second factor by configuring the server to require both password & key with the "AuthenticationMethods" directive
You can also configure it to require public key + U2F by specifying pubkey auth twice which will require two different pub keys but I suppose that would depend on the user having only 1 regular pubkey and one U2F pubkey in their authorized_keys file
Re: U2F Support in OpenSSH Head
#13Theoretically you could probably hack the U2F device protocol to _be_ your ssh key.
I've switched to using GPG and GPG-Agent as my SSH identity however. I keep my PGP key on a Nitrokey and keep it with me.
Re: U2F Support in OpenSSH Head
#14Earlier quoted context omitted.
Neat, Can you update us with their reply? :)
I absolutely will. I offered that they could reply directly and I'd update-- or that they could come school me in public if they disagree with me and preferred to reply in public. :)
Yes, please update this thread!
Re: U2F Support in OpenSSH Head
#15You can use U2F with SSH today by making U2F a pam authentication requirement... though this normally requires some copy and paste of the u2f challenge and response since your terminal doesn't know to do that and the ssh client software itself doesn't recognize the U2F challenge. Making it easier would be really nice. The linked post really unclear to me about the security properties provided. This document ( https:/…
> If the goal wasn't to require the key file-- why store the key handle there at all and not just derive it from data sent by the server as in a more typical U2F application? The only other advantage I see is potentially limiting some cros-domain attacks (e.g. where server A provides server B's key handle). I was also a little surprised this isn't used as a second factor, like Universal 2nd Factor is meant to be used…
> I was also a little surprised this isn't used as a second factor, like Universal 2nd Factor is meant to be used. But maybe it's not so surprising given there are at this moment probably more U2F keys
Even with just U2F, the public key you install on the server could include both the "key handle" and the derived public key... then the ssh client doesn't need to know anything (except perhaps that its should prompt you to use the device).
Re: U2F Support in OpenSSH Head
#16Anything that makes SSH authentication secure and easy to use is a win for me and many others!
Just wondering, is there an NFC-based U2F key out there? Would really like being able to use that with my phone as well if an app can support it.
Re: U2F Support in OpenSSH Head
#17Anything that makes SSH authentication secure and easy to use is a win for me and many others! Just wondering, is there an NFC-based U2F key out there? Would really like being able to use that with my phone as well if an app can support it.
The Yubikey 5 NFC [0] has NFC and works in Android.
Re: U2F Support in OpenSSH Head
#18Theoretically you could probably hack the U2F device protocol to _be_ your ssh key. I've switched to using GPG and GPG-Agent as my SSH identity however. I keep my PGP key on a Nitrokey and keep it with me.
> Theoretically you could probably hack the U2F device protocol to _be_ your ssh key.
That's exactly what this is.
Re: U2F Support in OpenSSH Head
#19Is the Nitrokey supported? I didn't see it.
I understand OpenSSH is going to support the FIDO U2F standard in which case all standard-conform implementations would work, including Nitrokey FIDO U2F devices.
Re: U2F Support in OpenSSH Head
#20Theoretically you could probably hack the U2F device protocol to _be_ your ssh key. I've switched to using GPG and GPG-Agent as my SSH identity however. I keep my PGP key on a Nitrokey and keep it with me.
> Theoretically you could probably hack the U2F device protocol to _be_ your ssh key. That's exactly what this is.
I see this now. When I first glanced at it, I thought it was another PAM module