How will this work with agents?
That's the neat part, it doesn't
Now that's just incorrect
Hardware Touch, Stronger SSH
21–30 of 53 posts
Re: Hardware Touch, Stronger SSH
#22This is how you handle it as an individual developer, but in a corporate environment things get real difficult, real fast. You need to set up your VMs and Git host to only trust certificates signed by an SSH certificate authority, and you need to work with users to submit the public key from the hardware-backed key to IT (controlling the CA) to get the public key signed and a certificate issued. Establishing trust wh…
I can't speak to actually setting it up, but where I work we have an IT-provided yubikey ssh-agent that handles getting all that stuff set up, and we just paste the public key from our individual yubikeys into our authorized ssh keys with our on-prem-hosted bitbucket server. However almost everyone I know quickly gets sick of touching the yubikey for every git remote operation and just generates their own local SSH key to use for git since doing so is not forbidden. It's definitely not High Security, but since our git is on-prem and can only be accessed from within the corporate VPN the risks are probably lower than if we were using something shared on the public internet.
Re: Hardware Touch, Stronger SSH
#23This is how you handle it as an individual developer, but in a corporate environment things get real difficult, real fast. You need to set up your VMs and Git host to only trust certificates signed by an SSH certificate authority, and you need to work with users to submit the public key from the hardware-backed key to IT (controlling the CA) to get the public key signed and a certificate issued. Establishing trust wh…
If you aready have an SSH CA, why not just issue ephemeral certs lasting for several seconds or minutes? What risk would be addressed by adding hardware keys into the mix?
Re: Hardware Touch, Stronger SSH
#24I bought several "Security Key NFC by Yubico": their cheapest model, no storage or fancy stuff. My personal strategy is to use keys generated this way: ssh-keygen -t ed25519-sk Rules: - A generated key never leave the machine it was generated on. - ssh agent is never used - ProxyJump in HOME/.ssh/config or -J to have convenient access to all my servers. - DynamicForward and firefox with foxyproxy extension to access…
[deleted]
Re: Hardware Touch, Stronger SSH
#25SSH using GPG Yubikeys and git signing using GPG was quite a process to set up on Windows a few years ago. Not something I'd want or know how to repeat. Hopefully things have improved in the mean time.
You can use SSH keys for signing now, so you don't need GPG at all.
Re: Hardware Touch, Stronger SSH
#26This is how I've been doing it: https://stosb.com/blog/using-openpgp-keys-for-ssh-authentica...
Slightly different as I generate a PGP key on the computer and then load it to the Yubikey, which means I can have backup keys with the same secret keys.
I never really got "touch to use" working though, if anyone knows how to do it with GPG keys I'd really appreciate it!
Re: Hardware Touch, Stronger SSH
#27ssh-add -c (confirm) can somehow mitigate the "misuse of ssh-agent in the background" the article is talking about
Re: Hardware Touch, Stronger SSH
#28In my opinion only, Yubico has done no favors to the Fido by their marketing. A result of trying to make Yubikey synonymous with Fido, it has become unclear what Fido does. And as a result of how they market their keys, decisions Fido keys are presented with a cost of $20 - $60. Why $60, for a simple Fido key? Because for $60 you get not only Fido, but Flippo, Froggo, x.6s8o and more-o. The result is that most people…
while you are right, security is generally not cheap. you can get that $5 china fido key, but are you sure it's you who owns it? I was recently looking for a security key, and eventually I did pay the yubico tax, because saving $20 by getting another one seemed unwise given the stakes.
>you can get that $5 china fido key, but are you sure it's you who owns it?
Seems like a moot point because it'd be very difficult for a rogue fido key to exfiltrate data. I'd be far more concerned about random chinese IOT gadgets, which most people don't have a problem with.
Re: Hardware Touch, Stronger SSH
#29In my opinion only, Yubico has done no favors to the Fido by their marketing. A result of trying to make Yubikey synonymous with Fido, it has become unclear what Fido does. And as a result of how they market their keys, decisions Fido keys are presented with a cost of $20 - $60. Why $60, for a simple Fido key? Because for $60 you get not only Fido, but Flippo, Froggo, x.6s8o and more-o. The result is that most people…
>I am not pointing at Yubico as they have done well making profits from corporations. Rather the Fido Alliance. Looking at the Fido Alliance provides a first pass at answering the question "Who Benefits?"
>https://fidoalliance.org/overview/leadership/
>Perhaps it is fair to ask "What benefit" as well.
>Corpocracy. You gotta love it.
You're really beating around the bush, trying to imply there's something shady going on, but don't articulate what it actually is. So let me ask: what's the conspiracy here? That the fido alliance is a front for an evil cabal of tech companies trying to... improve security? sell overpriced security keys?
Re: Hardware Touch, Stronger SSH
#30I bought several "Security Key NFC by Yubico": their cheapest model, no storage or fancy stuff. My personal strategy is to use keys generated this way: ssh-keygen -t ed25519-sk Rules: - A generated key never leave the machine it was generated on. - ssh agent is never used - ProxyJump in HOME/.ssh/config or -J to have convenient access to all my servers. - DynamicForward and firefox with foxyproxy extension to access…
The more expensive one works as smart card so you can both generate and keep the key as hardware only. Works for SSH and GPG too
The generated FIDO keys with "[...]-sk" are hardware-only too, the "key" you load is only an "identifier" associating the onboard passkey, allowing you to add it on multiple computers but still requiring the FIDO key present to use[1]:
> ssh-keygen(1) may be used to generate a FIDO token-backed key, after which they may be used much like any other key type supported by OpenSSH, so long as the hardware token is attached when the keys are used. FIDO tokens also generally require the user explicitly authorise operations by touching or tapping them.
> [...]
> This will yield a public and private key-pair. The private key file should be useless to an attacker who does not have access to the physical token. After generation, this key may be used like any other supported key in OpenSSH and may be listed in authorized_keys, added to ssh-agent(1), etc. The only additional stipulation is that the FIDO token that the key belongs to must be attached when the key is used.
IMO the baseline Security Key ($20) series is now enough, unless your setup uses PGP, legacy SSH that doesn't support these key types, or if you're using a real certificate for e.g. code signing.
1: https://www.openssh.org/txt/release-8.2#:~:text=The%20privat...