Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use FIDO2 USB keys with SSH

stavros.io

Post reply on HN
Print view View original

41–50 of 99 posts

Re: How to use FIDO2 USB keys with SSH

#41

Post by tialaramex »

jjoonathan wrote: post #20
spiridow wrote: post #10

I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: https://news.ycombinator.com/item?id=23689606

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

In a browser what you want is WebAuthn, U2F is an older never technically standardized hack and should not be used for new implementations.

New web sites should do WebAuthn to enable this functionality, here's a guide someone else wrote that I found helpful in talking about the moving parts to actually implement this: https://webauthn.guide/

Firefox's WebAuthn implementation isn't as complete as it would ideally be, but it does have a nice feature of asking the user whether to give out the somewhat privacy-infringing "attestation" from a FIDO2 device when it is requested by a web site. IMNSHO ordinary web sites, especially where a second factor isn't even mandatory, should not be asking for attestation and I always refuse.

Re: How to use FIDO2 USB keys with SSH

#42

Post by StavrosK »

DCKing wrote: post #40
StavrosK wrote: post #37

Earlier quoted context omitted.

Read farther down, you don't need this key, you can delete it if you want. You'll just have to run `ssh-add -K` every session if you do, so your agent reads the key from the device.

Ah I missed that. My apologies, I learned something new!

No problem, it's a fantastic way to use SSH, I'm just glad it exists.

Re: How to use FIDO2 USB keys with SSH

#43

Post by staticassertion »

michaelt wrote: post #4

> be extra careful when using SSH forwarding (the -A option), as the server can then ask your computer to authenticate to other servers on your behalf. That would require an extra press of the token's button for each extra authentication, right?

I would assume the agent caches the key for signing.

Would someone please confirm this? If it did require another key press that would be pretty huge.

Re: How to use FIDO2 USB keys with SSH

#44

Post by StavrosK »

tialaramex wrote: post #41
jjoonathan wrote: post #20

Earlier quoted context omitted.

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

In a browser what you want is WebAuthn, U2F is an older never technically standardized hack and should not be used for new implementations. New web sites should do WebAuthn to enable this functionality, here's a guide someone else wrote that I found helpful in talking about the moving parts to actually implement this: https://webauthn.guide/ Firefox's WebAuthn implementation isn't as complete as it would ideally be,…

Oh is that what the "anonymize this key" is? If the website requires attestation, authentication might fail, but no website should require attestation, maybe unless you explicitly got the key from them (like a bank).

Re: How to use FIDO2 USB keys with SSH

#46

Post by tialaramex »

simias wrote: post #23

I've been using my Yubikey in GnuPG smartcard mode for years to do the same thing, from what I can see from this tutorial FIDO2 seems a bit easier to setup initially but it also seems much less widely supported at the moment. Are there other tradeoffs to consider?

Going FIDO-SSH can perhaps be cheaper than PIV, especially if, as we very much want, FIDO is popular which will tend to drive down prices.

Cheaper/ simpler FIDO2 products (from Yubico) exist if this feature is the only thing you want from a Yubikey. I don't know if that's a future Yubico are enthusiastic about, but I don't see much reason to hate it as an end user.

Even cheaper and even simpler FIDO products (from many vendors) exist if you only ever actually want this from one or two systems (e.g. a laptop and then one desktop workstation) so you don't need resident keys because the "non-resident" part lives on your workstation.

Re: How to use FIDO2 USB keys with SSH

#47

Post by nobodyshere »

StavrosK wrote: post #18
nobodyshere wrote: post #13

Earlier quoted context omitted.

Can't make that part work on Mac.

Unfortunately, MacOS still ships with SSH 8.1, AFAIK.

I installed 8.3 through homebrew but its agent just doesn't allow me to do that. Also can't ssh-add an sk key.

Re: How to use FIDO2 USB keys with SSH

#48

Post by tialaramex »

staticassertion wrote: post #43
michaelt wrote: post #4

> be extra careful when using SSH forwarding (the -A option), as the server can then ask your computer to authenticate to other servers on your behalf. That would require an extra press of the token's button for each extra authentication, right?

I would assume the agent caches the key for signing. Would someone please confirm this? If it did require another key press that would be pretty huge.

> I would assume the agent caches the key for signing.

For that to happen the agent would need to have some way to get the key out of the FIDO authenticator, which is deliberately not intended to be possible. I will now go away and confirm that this behaves as I expected and update this message shortly.

Update: Yes, the OpenSSH agent just has code to go talk to the authenticator each time it needs to sign something. The authenticator may or may not (most seem to not) allow this to happen without verifying user presence (e.g. via a button press or touching a contact) but even if your device does allow this the signed payload says whether the user was present, so a remote SSHD can (if it wanted) demand to see signed evidence of user presence or refuse login, and I think a SSH agent can't fake that without help from the FIDO authenticator itself.

Re: How to use FIDO2 USB keys with SSH

#49

Post by staticassertion »

tialaramex wrote: post #48
staticassertion wrote: post #43

Earlier quoted context omitted.

I would assume the agent caches the key for signing. Would someone please confirm this? If it did require another key press that would be pretty huge.

> I would assume the agent caches the key for signing. For that to happen the agent would need to have some way to get the key out of the FIDO authenticator, which is deliberately not intended to be possible. I will now go away and confirm that this behaves as I expected and update this message shortly. Update: Yes, the OpenSSH agent just has code to go talk to the authenticator each time it needs to sign something.…

Oh duh, of course. Yes please confirm! Super eager to hear if this is the case.

Re: How to use FIDO2 USB keys with SSH

#50

Post by StavrosK »

nobodyshere wrote: post #47
StavrosK wrote: post #18

Earlier quoted context omitted.

Unfortunately, MacOS still ships with SSH 8.1, AFAIK.

I installed 8.3 through homebrew but its agent just doesn't allow me to do that. Also can't ssh-add an sk key.

Hmm, are you sure you aren't calling the agent of the old one?
Post reply on HN