How to use FIDO2 USB keys with SSH

#1

Post by stelabouras » Tue, Jun 30, 2020, 12:53 PM UTC

How to use FIDO2 USB keys with SSH
stavros.io

Re: How to use FIDO2 USB keys with SSH

#2

Post by RL_Quine » Tue, Jun 30, 2020, 1:20 PM UTC

Be aware literally nothing supports this unless it's your own kernel.

Gitlab? No. Github? No. My gateway with a hand built gentoo kernel? Yes.

It seems functional, but you've also got to be aware that `ed25519-sk` and `ecdsa-sk` have sort of spotty support in the devices too. `ed25519-sk` does not work on a Yubikey <5, for example.

Re: How to use FIDO2 USB keys with SSH

#3

Post by StavrosK » Tue, Jun 30, 2020, 1:24 PM UTC

RL_Quine wrote: post #2

Be aware literally nothing supports this unless it's your own kernel. Gitlab? No. Github? No. My gateway with a hand built gentoo kernel? Yes. It seems functional, but you've also got to be aware that `ed25519-sk` and `ecdsa-sk` have sort of spotty support in the devices too. `ed25519-sk` does not work on a Yubikey <5, for example.

> Be aware literally nothing supports this unless it's your own kernel.

Ubuntu 20.04 and later supports this, and, since that's LTS, it means that quite a few servers and machines will be supporting it already.

Github/Gitlab aren't supporting it yet, but given how great it is for security, I think they have a big incentive to speed up support.

> ed25519-ek does not work on a Yubikey That's no problem, since you can just generate an ECDSA key instead, but yes, not all keys have hardware support for all algorithms.

Re: How to use FIDO2 USB keys with SSH

#4

Post by michaelt » Tue, Jun 30, 2020, 1:26 PM UTC

> be extra careful when using SSH forwarding (the -A option), as the server can then ask your computer to authenticate to other servers on your behalf.

That would require an extra press of the token's button for each extra authentication, right?

Re: How to use FIDO2 USB keys with SSH

#5

Post by dboreham » Tue, Jun 30, 2020, 1:27 PM UTC

I've waited 10 years for this.

Re: How to use FIDO2 USB keys with SSH

#6

Post by nobodyshere » Tue, Jun 30, 2020, 1:27 PM UTC

RL_Quine wrote: post #2

Be aware literally nothing supports this unless it's your own kernel. Gitlab? No. Github? No. My gateway with a hand built gentoo kernel? Yes. It seems functional, but you've also got to be aware that `ed25519-sk` and `ecdsa-sk` have sort of spotty support in the devices too. `ed25519-sk` does not work on a Yubikey <5, for example.

Not exactly true. Ubuntu 20.04 supports this out of the box and lots of VMs therefore also do.

Re: How to use FIDO2 USB keys with SSH

#7

Post by StavrosK » Tue, Jun 30, 2020, 1:30 PM UTC

michaelt wrote: post #4

> be extra careful when using SSH forwarding (the -A option), as the server can then ask your computer to authenticate to other servers on your behalf. That would require an extra press of the token's button for each extra authentication, right?

That's a good point, I haven't tried it but I think you're right, which is another great benefit of using hardware tokens.

Re: How to use FIDO2 USB keys with SSH

#8

Post by StavrosK » Tue, Jun 30, 2020, 1:31 PM UTC

dboreham wrote: post #5

I've waited 10 years for this.

Same here, and I just absolutely love how well it works. Now if Android SSH apps add support for it, my SSH life will be complete.

Re: How to use FIDO2 USB keys with SSH

#9

Post by Bedon292 » Tue, Jun 30, 2020, 1:32 PM UTC

Am I missing something? The commands for resident and non-resident appear to be identical.

Edit: They fixed it.

Re: How to use FIDO2 USB keys with SSH

#10

Post by spiridow » Tue, Jun 30, 2020, 1:36 PM UTC

I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: https://news.ycombinator.com/item?id=23689606