While we're at this - is there anyway for sudo NOT to ask for password when logged in via key authentication?
How to Store an SSH Key on a Yubikey
101–110 of 154 posts
Re: How to Store an SSH Key on a Yubikey
#102Earlier quoted context omitted.
Sounds like FUD to me. If you lose your primary method you have to remember the password to unlock your secondary software ssh key.. Possibly remembering a password is a huge crisis but I had that crisis before using tokens, i.e. returning to my work desktop after a vacation.
> If you lose your primary method you have to remember the password to unlock your secondary software ssh key.. The post I was replying to was talking about 2FA in general, not just for SSH keys. Many people take the advertisements of Facebook, Google, Twitter et al. to push for 2FA as pure gospel, but completely neglect "worst case recovery" scenarios - and then run into stone walls when it inevitably happens, becau…
AWS not offering multiple 2FA keys is one of my biggest annoyances, its a service that I feel much have 2FA due to its ability to run up extreme bills, but I also cant setup a backup key in case of loss or failure.
Re: How to Store an SSH Key on a Yubikey
#103I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…
I was thinking the same initially. But I've been using my Yubikey for 6 or 7 years now, haven't lost it, haven't lost the recovery key which you create during initial setup, and it survived three times being machine washed. I don't know your full situation, but I'd say people are generally much better at not losing things than they think they are.
Re: How to Store an SSH Key on a Yubikey
#104Earlier quoted context omitted.
That's a very good question and in my opinion the biggest flaw with almost all new 2FA/passwordless systems. The "best practice" is to get a second yubikey or store recovery codes on paper, but that requires keeping them close to you because you'll need to update your backup on every new signup. That makes these systems entirely useless at protecting against house fires, signups while away from home, or simply servic…
For signups away from home, use the key you have then add the second when you get home.
I sign up for a lot of services when I'm on vacation (local taxi, event and tour guides that now require apps, SIM card contracts, etc). Losing/breaking small electronics is a big risk when traveling, so I wouldn't use Yubikeys for those even if they are supported.
Re: How to Store an SSH Key on a Yubikey
#105I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…
You can generate keys off-yubikey and store them in a safe encrypted backup somewhere offline/online/wherever.
Then just import those keys into yubikey and use that.
Ideally though you would rotate keys if you lost your yubikey because you never know if the password was compromised or not.
Re: How to Store an SSH Key on a Yubikey
#106Earlier quoted context omitted.
No. There is no way to push a value for the symmetric key that probably makes the FIDO (thus U2F / WebAuthn) feature work. You can tell the Yubikey to pick a random new one, effectively wiping your key (and rendering any credentials previously minted with it now invalid) but you can't write one over USB and this was I believe intentional.
Thanks. I will wait until it’s actually possible to create back up webauthn keys (rather than enlisting two keys with every service).
There is actually at least one fido2 device that supports backing up (mostly), based on this spec from Dicekeys https://github.com/dicekeys/seeding-webauthn
Solokeys (https://solokeys.com/ - v1, don't think the newer v2 does) have a special firmware version that implements this and allows you to use a custom seed - and as such restore a key from it. It only works on non-resident credentials (most commonly used, as the number of RKs is usually very limited) though. The firmware is here https://github.com/conorpp/solo-dicekeys/releases/tag/5.0.0 But it's also shipped in the keys dicekeys sells and I think only their app implements the client side of seeding anyway: https://www.crowdsupply.com/dicekeys/dicekeys
Re: How to Store an SSH Key on a Yubikey
#107You can use a GPG key stored on a YubiKey with openssh, but with some caveats: 1. gpg-agent must act as your ssh-agent (which means ssh-agent should be disabled and replaced by gpg-agent). 2. If using `pinentry-curses` (YubiKey usually permits access to the contained GPG key via the use of a pin), you must have `export GPG_TTY=$(tty)` (or your shell's equivalent of setting the GPG_TTY environment value to the output…
I am using this setup for a while now and would like to tell everyone about an advantage in contrast to the 'resident key': You can push a single, identical key to two YubiKeys, making it easier to recover.
Resident keys are (partially?) created on the hardware token and thus can't be replicated. The GPG keys can be pushed to a couple of YubiKeys before you delete them forever (or keep a paper backup somewhere safe).
Re: How to Store an SSH Key on a Yubikey
#108Is there a way to show which SSH keys are loaded on the Yubikey? (It looks like you can store multiple)
Also, how can one remove the SSH keys from the Yubikey?
I've tried to find articles and SSH on the Yubikey gets very confusing as there seem to be so many techniques!
Re: How to Store an SSH Key on a Yubikey
#109Is there a way to show which SSH keys are loaded on the Yubikey? (It looks like you can store multiple) Also, how can one remove the SSH keys from the Yubikey? I've tried to find articles and SSH on the Yubikey gets very confusing as there seem to be so many techniques!
In the blogpost they give an example of exactly that
$ ssh-add -L
sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKgGePSwpBuHUhrFCRLch9Usqi7L0fKtgTRnh6F/R+ruAAAABHNzaDo= cadey@shachi
Re: How to Store an SSH Key on a Yubikey
#110I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…
Any system with a backdoor can be exploited. Keep a large number of spare keys that are revokable instead.
Given my "threat model", I don't need a lot of security, so that's one on my person, two other places that are in tamper evident containers.