Yubikey-agent

I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out.…

Ok so this is neat; while the newest openssh client/server directly supports u2f keys, this is a badass shim that creates NIST-p256 compatible keys that are backed by a…

The new OpenSSH keys are very convenient if used correctly, but have a crucial disadvantage compared to the PIV-based approach of yubikey-agent: They currently can't be protected…

The new OpenSSH keys are very convenient if used correctly, but have a crucial disadvantage compared to the PIV-based approach of yubikey-agent: They currently can't be protected…

The tokens are engineered to protect the private key material stored inside them very well, so you can be quite certain that nobody will ever be able to log in without physical…

> Do you know if this already works with GitHub? It does not. From an `ssh -vvv git@github.com -i <path/to/sk key>` session: ``` debug1: Next authentication method: publickey…

> The downside is that both sides have to be running SSH 8.2+. This is the problem. I was really excited for FIDO SSH keys, but LTS server distributions don't support it so it's…

Half of our servers are Ubuntu 14.04, the rest 18.04. I'll wager that it's not gonna be in either of these releases. You should specify which lts you're talking about with a…

Can you register multiple devices for the same SSH key, so you have a backup in case one gets lost or breaks?

Would it be possible (or would patches be accepted) to talk to the GnuPG scdaemon instead? This would let me use gpg-agent to sign and encrypt.

Sounds really easy but how do you backup this key to another Yubikey? Or do you simply have two, and always add two keys to each server?

Can such a key be used as an aws key?

I use gpg-agent, but I agree it is often a pain. I will probably switch to U2F + SSH once more servers have OpenSSH 8.2. Do you know if this already works with GitHub?

Hmm, gpg-agent has worked nicely for me. The biggest pain is that I have to reconfigure when I switch yubikey. (Yes, I have multiple keys with the same gpg key on each)

I use it with PKCS#11 mode and can't confirm some of the drawbacks the author mentions under Alternatives: > The UX of this solution is poor: [...] and needs manual reloading…

It surely depends on the OS, and on the PKCS#11 implementation. I tested ykcs11 and OpenSC on macOS and they were like I described. I had started this project as a simple setup…

You can also use Trezor.io instead of Yubikey for ssh login. https://blog.trezor.io/openssh-with-fido2-and-trezor-e565c2277 Advantage of Trezor is that it has better backup…

I want to mention a Yubikey alternative that runs on open-source firmware and software: OnlyKey [1] It has an onlykey-agent that works as an SSH agent [2]. It doesn't work as a…

I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out.…