Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

61–70 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#61

Post by knorker »

vladvasiliu wrote: post #2

> As of OpenSSH 8.2 (Feburary 14, 2020) you are able to store an SSH private key on a yubikey! Here's how to do it. Many systems still don't have OpenSSH 8.2 (Windows 11, older debian stable, etc). For those, another solution is to use the PGP applet of the YubiKey, which exposes a regular RSA key. This guide has worked well for me: https://github.com/drduh/YubiKey-Guide You can jump to the SSH sections if that's all…

Not to mention all the network appliances in the world.

While this only works for a subset I'll stay with my RSA key in PIV mode on yubikey. Works great.

Re: How to Store an SSH Key on a Yubikey

#62

Post by jve »

vladvasiliu wrote: post #2

> As of OpenSSH 8.2 (Feburary 14, 2020) you are able to store an SSH private key on a yubikey! Here's how to do it. Many systems still don't have OpenSSH 8.2 (Windows 11, older debian stable, etc). For those, another solution is to use the PGP applet of the YubiKey, which exposes a regular RSA key. This guide has worked well for me: https://github.com/drduh/YubiKey-Guide You can jump to the SSH sections if that's all…

Another solution for windows: The support is already there within 8.9.1.0 beta release: https://github.com/PowerShell/Win32-OpenSSH/releases

You must then use the SSH installed within 'C:\Program Files\OpenSSH\ssh.exe' and not the builtin within system32.

Re: How to Store an SSH Key on a Yubikey

#63

Post by fmajid »

Yubikey Manager is not needed to use ed25519-sk keys. They use only FIDO U2F functionality, so cheaper USB keys ($29 for a Yubico Security Key USB-C NFC vs $55 for the full Yubikey 5C NFC).

They are thus not limited to Yubico's proprietary functionality controlled by Manager, which has a wider attack surface than I am comfortable with, and are not limited to platforms running the Yubikey Manager software (e.g. on OpenBSD). Since the key has never been outside the USB enclave, there is no way it could have been surreptitiously copied, e.g. if there was a rootkit on the machine where the key was generated before copying to the Yubikey.

Re: How to Store an SSH Key on a Yubikey

#64

Post by jve »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

As others pointed out, you just add another factor (TOTP) or print backup codes.

Or just have another way to sign in. Generate random password for root user, store it in your password manager, disable root login via SSH and... whenever you find your user locked out, log via root via console. In a corporate environment, you could audit and alert whenever root logs in as it should be only "recovery" user.

Re: How to Store an SSH Key on a Yubikey

#65

Post by mywacaday »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

Out of interest if you lost both, what would you lose access to permanently?

Re: How to Store an SSH Key on a Yubikey

#66

Post by dnet »

stingraycharles wrote: post #8
enasterosophes wrote: post #3

Something else that is quite nice is that you can switch to certificate auth and use your yubikey to protect an ed25519-sk certificate authority.

How does that work, do you know a good tutorial for this?

I made my own CA for this because nothing else could provide transparency regarding certificate issuance (whether an attacker issued a "spare" backdoor certificate)

- source code: https://github.com/silentsignal/zsca

- my talk about the design and results: https://pretalx.hsbp.org/camppp7e5/talk/D3E9HN/

Re: How to Store an SSH Key on a Yubikey

#67

Post by infthi »

gruturo wrote: post #34
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

You're not wrong, but this is exactly the use case for a USB security stick. The key is in there, cannot be extracted in any way*, can only be "used" (not accessed or copied, just used for crypto operations) while the stick is plugged in, and without it it's impossible to proceed. It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be…

> cannot be extracted in any way

There was (is?) a vulnerability in Google Titan keys (and some Yubico products as well) that allowed cloning of keys (having a physical access is a pre-requisite).

https://news.ycombinator.com/item?id=25675556

Re: How to Store an SSH Key on a Yubikey

#68

Post by b112 »

groffee wrote: post #47
lordnacho wrote: post #28

Earlier quoted context omitted.

If your whole life is on your phone like me, just attach a yubi to your actual keychain (which is stuck to your phone) and then you'll always be thinking about where your phone/wallet/keys/security are all the time. Then put the second key on your desk. My yubi happens to be annoying to fiddle with since it's on my keychain, so I use the desk one for signing most of the time. If there's a house fire, you'll have your…

You're missing the scenario where the police take your phone and your electronics (and the yubi on your desk) and have access to all your accounts because of the yubi attached to it, and you're left locked out of everything.

I am often quite baffled by people using only the device.

The whole point of all this is "something you have, something you know".

Yet lots just have passwordless keys for ssh with their yubikey. Completely unsecure, unsafe in examples you cite, and more.

When using ssh keys for login, you should enforce remote/server password requirements and an ssh key. This is trivial to do in sshd_config, and important.

Never trust end users to have passwords on their ssh keys. Always enforce it server side.

Re: How to Store an SSH Key on a Yubikey

#69

Post by b112 »

lordnacho wrote: post #35
orev wrote: post #33

Earlier quoted context omitted.

Keychain stuck to your phone? I don’t think I’ve ever seen anyone with a setup like that. Sounds incredibly annoying.

Well I've only got one key on the chain, though my wife has a couple of them. Nothing too cumbersome, plus I have a strap that's useful for pulling the phone out of my pocket.

Wait, I read that quicky in your prior post. I thought you meant a software keychain.

If you ask me, drilling a hole in your phone will invalidate the warranty...

Post reply on HN