Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use FIDO2 USB keys with SSH

stavros.io

Post reply on HN
Print view View original

31–40 of 99 posts

Re: How to use FIDO2 USB keys with SSH

#31

Post by notaplumber »

DCKing wrote: post #29

EDIT: I misunderstood the post, and what I describe below is not true! I'm incredibly excited about FIDO2, but this is quite underwhelming honestly. I'd like to SSH with a credential on my Yubikey, not by a credential or configuration already stored on my computer that is unlocked by my Yubikey. I'd like to be able to plug in my Yubikey anywhere and go. My Linux desktop, my Macbook, my Windows desktop, my Android pho…

You can, that's exactly what resident keys in this article is referring to.

Once all of those platforms have a more recent OpenSSH, you can ssh-add -K to add keys to your SSH agent.

Re: How to use FIDO2 USB keys with SSH

#32

Post by stavros »

DCKing wrote: post #29

EDIT: I misunderstood the post, and what I describe below is not true! I'm incredibly excited about FIDO2, but this is quite underwhelming honestly. I'd like to SSH with a credential on my Yubikey, not by a credential or configuration already stored on my computer that is unlocked by my Yubikey. I'd like to be able to plug in my Yubikey anywhere and go. My Linux desktop, my Macbook, my Windows desktop, my Android pho…

You misunderstand how FIDO2 works. Read the article, it details how to do exactly what you say it can't. You can resume your excitement now!

Re: How to use FIDO2 USB keys with SSH

#33

Post by StavrosK »

RL_Quine wrote: post #30
StavrosK wrote: post #26

Earlier quoted context omitted.

I think those are pretty much the only ones, the Yubikey in GPG smartcard mode was always too fiddly for me and interfered with my agent in other ways, but this is trivial to set up and use. Also, a big draw of the USB SSH key for me is that I can plug it in to other computers and connect to my servers, which smartcard mode didn't do, so that was a big drawback for me.

You can't do that easily, you still need the public key file on disk.

Not with resident key mode.

Re: How to use FIDO2 USB keys with SSH

#34

Post by DCKing »

stavros wrote: post #32
DCKing wrote: post #29

EDIT: I misunderstood the post, and what I describe below is not true! I'm incredibly excited about FIDO2, but this is quite underwhelming honestly. I'd like to SSH with a credential on my Yubikey, not by a credential or configuration already stored on my computer that is unlocked by my Yubikey. I'd like to be able to plug in my Yubikey anywhere and go. My Linux desktop, my Macbook, my Windows desktop, my Android pho…

You misunderstand how FIDO2 works. Read the article, it details how to do exactly what you say it can't. You can resume your excitement now!

In that case I'll need to update my understanding, but this still requires you to do manual configuration for your SSH key - the id_mykey_sk file in your example.

> ssh-keygen -t ecdsa-sk -O resident -f ~/.ssh/id_mykey_sk

I know this is just a reference, but it's still manual configuration. On a host with an SSH client that can speak PIV [this is a challenge], I can just plug in, enter the PIV PIN code, and go.

Re: How to use FIDO2 USB keys with SSH

#35

Post by DCKing »

notaplumber wrote: post #31
DCKing wrote: post #29

EDIT: I misunderstood the post, and what I describe below is not true! I'm incredibly excited about FIDO2, but this is quite underwhelming honestly. I'd like to SSH with a credential on my Yubikey, not by a credential or configuration already stored on my computer that is unlocked by my Yubikey. I'd like to be able to plug in my Yubikey anywhere and go. My Linux desktop, my Macbook, my Windows desktop, my Android pho…

You can, that's exactly what resident keys in this article is referring to. Once all of those platforms have a more recent OpenSSH, you can ssh-add -K to add keys to your SSH agent.

I fully understand what kind of credentials FIDO2 can store - but as I read it this still requires manual configuration on individual devices.

Re: How to use FIDO2 USB keys with SSH

#36

Post by notaplumber »

DCKing wrote: post #35
notaplumber wrote: post #31

Earlier quoted context omitted.

You can, that's exactly what resident keys in this article is referring to. Once all of those platforms have a more recent OpenSSH, you can ssh-add -K to add keys to your SSH agent.

I fully understand what kind of credentials FIDO2 can store - but as I read it this still requires manual configuration on individual devices.

Nope. It's in the article. Just insert the key and ssh-add -K. I wouldn't be surprised if other SSH agents (e.g. Apple) added a UI to do this.

Re: How to use FIDO2 USB keys with SSH

#37

Post by StavrosK »

DCKing wrote: post #34
stavros wrote: post #32

Earlier quoted context omitted.

You misunderstand how FIDO2 works. Read the article, it details how to do exactly what you say it can't. You can resume your excitement now!

In that case I'll need to update my understanding, but this still requires you to do manual configuration for your SSH key - the id_mykey_sk file in your example. > ssh-keygen -t ecdsa-sk -O resident -f ~/.ssh/id_mykey_sk I know this is just a reference, but it's still manual configuration. On a host with an SSH client that can speak PIV [this is a challenge], I can just plug in, enter the PIV PIN code, and go.

Read farther down, you don't need this key, you can delete it if you want. You'll just have to run `ssh-add -K` every session if you do, so your agent reads the key from the device.

Re: How to use FIDO2 USB keys with SSH

#38

Post by microcolonel »

jjoonathan wrote: post #25
microcolonel wrote: post #21

Earlier quoted context omitted.

Just Works in Chromium and Brave on Arch Linux.

With or without udev tweaks? That has been the major caveat on linux in recent times.

I have no personal udev rules for my Yubikeys, just whatever ships with Arch.

Re: How to use FIDO2 USB keys with SSH

#39

Post by seqastian »

jjoonathan wrote: post #20
spiridow wrote: post #10

I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: https://news.ycombinator.com/item?id=23689606

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

Safari 14 should change that though.

https://developer.apple.com/documentation/safari-release-not...

Re: How to use FIDO2 USB keys with SSH

#40

Post by DCKing »

StavrosK wrote: post #37
DCKing wrote: post #34

Earlier quoted context omitted.

In that case I'll need to update my understanding, but this still requires you to do manual configuration for your SSH key - the id_mykey_sk file in your example. > ssh-keygen -t ecdsa-sk -O resident -f ~/.ssh/id_mykey_sk I know this is just a reference, but it's still manual configuration. On a host with an SSH client that can speak PIV [this is a challenge], I can just plug in, enter the PIV PIN code, and go.

Read farther down, you don't need this key, you can delete it if you want. You'll just have to run `ssh-add -K` every session if you do, so your agent reads the key from the device.

Ah I missed that. My apologies, I learned something new!
Post reply on HN