How to use FIDO2 USB keys with SSH • Hacker News Board

Re: How to use FIDO2 USB keys with SSH

#71

Post by DCKing » Tue, Jun 30, 2020, 7:20 PM UTC

traceroute66 wrote: post #55

DCKing wrote: post #29

EDIT: I misunderstood the post, and what I describe below is not true! I'm incredibly excited about FIDO2, but this is quite underwhelming honestly. I'd like to SSH with a credential on my Yubikey, not by a credential or configuration already stored on my computer that is unlocked by my Yubikey. I'd like to be able to plug in my Yubikey anywhere and go. My Linux desktop, my Macbook, my Windows desktop, my Android pho…

"Yubikey with GPG/PIV for SSH" There's no need to mess around with the GPG side of the Yubikey to get SSH working. Just the "plain" side of the Yubikey will work (which is great on a Mac because all you need is the basic dylibs - downloadable from Yubi and easily mv/cp installable in the relevant lib dir - rather than needing to mess around installing gpg). Added bonus is you enforce touch for key usage.

Yes, that's the PIV applet.

Re: How to use FIDO2 USB keys with SSH

#72

Post by jlgaddis » Tue, Jun 30, 2020, 7:53 PM UTC

tialaramex wrote: post #48

staticassertion wrote: post #43

Earlier quoted context omitted.

I would assume the agent caches the key for signing. Would someone please confirm this? If it did require another key press that would be pretty huge.

> I would assume the agent caches the key for signing. For that to happen the agent would need to have some way to get the key out of the FIDO authenticator, which is deliberately not intended to be possible. I will now go away and confirm that this behaves as I expected and update this message shortly. Update: Yes, the OpenSSH agent just has code to go talk to the authenticator each time it needs to sign something.…

> ... so a remote SSHD can (if it wanted) demand to see signed evidence of user presence or refuse login, ...

I'd like to be able to, server-side, 1) require that the private key used for authentication be stored on a hardware device and 2) require user presence, but I've never read or heard that this is possible (granted, I haven't looked into too much).

If you have links to any documents that discuss how to implement this, I'd appreciate you sharing them. The only relevant documentation I can find is regarding FIDO/U2F support and even the release notes for 8.2 mention that "OpenSSH does not currently make use of this [attestation certificate]".

Re: How to use FIDO2 USB keys with SSH

#73

Post by closeparen » Tue, Jun 30, 2020, 7:57 PM UTC

knorker wrote: post #68

dboreham wrote: post #5

I've waited 10 years for this.

Waited 10 years? Why didn't you just use a yubikey in PIV mode, or the yubikey with gpg, or a smartcard, or… I've been using a yubikey PIV for, hmm… at least 5 years. Sure, a FIDO key is cheaper.

OpenSSH doesn't do X.509, how would PIV mode or a smartcard help?

Re: How to use FIDO2 USB keys with SSH

#74

Post by Xylakant » Tue, Jun 30, 2020, 8:11 PM UTC

closeparen wrote: post #73

knorker wrote: post #68

Earlier quoted context omitted.

Waited 10 years? Why didn't you just use a yubikey in PIV mode, or the yubikey with gpg, or a smartcard, or… I've been using a yubikey PIV for, hmm… at least 5 years. Sure, a FIDO key is cheaper.

OpenSSH doesn't do X.509, how would PIV mode or a smartcard help?

Yubikeys work in PIV mode with openssh, it just requires the necessary module and some invocation dance with ssh-agent https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK... or Filippo Valsordas yubikey-agent https://github.com/FiloSottile/yubikey-agent

Re: How to use FIDO2 USB keys with SSH

#75

Post by mightybyte » Tue, Jun 30, 2020, 8:13 PM UTC

michaelt wrote: post #4

> be extra careful when using SSH forwarding (the -A option), as the server can then ask your computer to authenticate to other servers on your behalf. That would require an extra press of the token's button for each extra authentication, right?

It depends on how you configured your Yubikey. I believe you can configure it both ways.

Re: How to use FIDO2 USB keys with SSH

#76

Post by xaduha » Tue, Jun 30, 2020, 9:24 PM UTC

knorker wrote: post #68

dboreham wrote: post #5

I've waited 10 years for this.

Waited 10 years? Why didn't you just use a yubikey in PIV mode, or the yubikey with gpg, or a smartcard, or… I've been using a yubikey PIV for, hmm… at least 5 years. Sure, a FIDO key is cheaper.

BTW both PIV and GPG in Yubikeys are just applets and not particularly suited for SSH use either. Proper applet for it is this one https://github.com/philipWendland/IsoApplet, if you can install it of course.

Some get confused or have bad associations when hearing the word 'applet', but that is what they are, as in 'Java applet'.

This one is too https://developers.yubico.com/ykneo-oath/Releases/

Re: How to use FIDO2 USB keys with SSH

#77

Post by crote » Tue, Jun 30, 2020, 10:10 PM UTC

tialaramex wrote: post #54

simias wrote: post #52

Earlier quoted context omitted.

I always assumed that the relatively high price of the Yubikey had more to do with it being a relatively niche product than the cost of production, after all it's not much more than a cheap microcontroller underneath all that. Was I wrong to make this assumption? Why would FIDO tokens be significantly cheaper and/or more popular? If anything it seems like at first it's going to fragment the market even more.

A full-blown Yubikey has modifiable firmware and a relatively large amount of rewritable Flash storage. I assume those features aren't free. A FIDO authenticator has no modifiable state beyond maybe some sort of counter, it has a random secret key which makes it unique from its siblings, and that's it. No firmware update feature, no storage. The crypto hardware is also simpler. FIDO was defined in terms of these nice…

That's not really true anymore. Yubikeys haven't supported firmware modification for years due to security reasons, and FIDO2 keys often have storage in order to support Resident Keys.

Re: How to use FIDO2 USB keys with SSH

#78

Post by acdha » Tue, Jun 30, 2020, 10:38 PM UTC

simias wrote: post #23

I've been using my Yubikey in GnuPG smartcard mode for years to do the same thing, from what I can see from this tutorial FIDO2 seems a bit easier to setup initially but it also seems much less widely supported at the moment. Are there other tradeoffs to consider?

If it's been stable for you, that definitely works well but I found OpenSC to be unstable and required hotplugging the device and/or killing gpg-agent on a regular basis.

Mac users do have built-in support which works the same way with certificates and is more stable in my experience:

https://piv.idmanagement.gov/engineering/ssh/#ssh-from-macos

Re: How to use FIDO2 USB keys with SSH

#79

Post by graton » Tue, Jun 30, 2020, 10:43 PM UTC

I was able to get this going, but it took awhile as I use a non-standard working mode.

All of the docs I have read assume that you are logged in locally on the system, but if you are not (like me) then things fall apart.

I am running a Windows 10 desktop, and then SSH into my local Linux box from Windows. Both systems are sitting next to me and I can press the Yubikey easily.

My local Linux system is running Fedora 32 and I did the following to enable a user connected via SSH to use the Yubikey.

Created a user group for yubikey users, which in reality only has me in it.

Created a /etc/polkit-1/rules.d/99-pcsc-yubikey.rules file which gives smartcard access to the 'yubikey' group. Without this then 'ykman list' would not work.

Created a /etc/udev/rules.d/99-yubikey.rules to give access to the 'yubikey' group. I used /lib/udev/rules.d/69-yubikey.rules as the starting point for my file. I had to add my two Yubikeys USB IDs (lsusb to see them) as they weren't present.

Made sure to log out and back in to have the 'yubikey' group be active for my user. I vaguely remember a command that would do it, but I forgot it.

After all of that I got it to work :)

Re: How to use FIDO2 USB keys with SSH

#80

Post by tialaramex » Tue, Jun 30, 2020, 11:35 PM UTC

jlgaddis wrote: post #72

tialaramex wrote: post #48

Earlier quoted context omitted.

> I would assume the agent caches the key for signing. For that to happen the agent would need to have some way to get the key out of the FIDO authenticator, which is deliberately not intended to be possible. I will now go away and confirm that this behaves as I expected and update this message shortly. Update: Yes, the OpenSSH agent just has code to go talk to the authenticator each time it needs to sign something.…

> ... so a remote SSHD can (if it wanted) demand to see signed evidence of user presence or refuse login, ... I'd like to be able to, server-side, 1) require that the private key used for authentication be stored on a hardware device and 2) require user presence, but I've never read or heard that this is possible (granted, I haven't looked into too much). If you have links to any documents that discuss how to impleme…

So there's two parts, let's take them separately.

> 1) require that the private key used for authentication be stored on a hardware device

So for this you're going to need the attestation data, which as you observe OpenSSH currently doesn't do anything with. It is willing to stash it in a file, and because it's a certificate it's safe for the token's owner to send this somewhere. So you could construct a mechanism to examine the attestation file and decide whether to accept the proffered public key based on that attestation. e.g. "This is a genuine Yubikey 5C, so OK" or "This is a Crap Corp Funky Fake, no thanks".

I expect this would be a bunch of work, and I don't expect Free Software people to help build something to do it any time soon. But from what I can see it's possible with the components that already exist. Maybe somebody who really wants this will do all the work and put it on GitHub.

> 2) require user presence

The FIDO "options" bitflags have a flag for "user presence" (sometimes labelled UP). If this isn't set, user presence was not checked by the authenticator.

The FIDO authenticator includes this options parameter as part of the message it's signing.

So this means if a SSH client/ agent sends you an options field with UP set, but actually user presence wasn't checked it won't be able to provide a signature that matches. The SSH server doesn't need to do anything special except look at the UP bitflag if it cares (all WebAuthn servers are required to check this, it's on the long list of steps to perform WebAuthn authentication properly).

To be fair this isn't OpenSSH (though I'm sure they have at least somebody paying attention) it's FIDO itself that designed the signatures to also sign the user presence indication, they couldn't have avoided it.