{"id":69,"date":"2023-02-05T12:53:36","date_gmt":"2023-02-05T10:53:36","guid":{"rendered":"https:\/\/dilyan.be\/?p=69"},"modified":"2023-03-31T10:31:05","modified_gmt":"2023-03-31T08:31:05","slug":"yubikey-for-ssh-authentication-with-fido2","status":"publish","type":"post","link":"https:\/\/dilyan.be\/?p=69","title":{"rendered":"Yubikey for ssh authentication with FIDO2"},"content":{"rendered":"

Yubikey<\/a> is my preferred solution for securing social account (Twitter, Facebook, Google), WordPress admin accounts, Git, Apple ID (since the iOS 16.3, and you need two keys) and OpenSSH (since v 8.2p1).<\/p>\n

The Yubico how-to<\/a> is great, I will just add couple of specifics on configuring the server and the clients.<\/p>\n

I chose the “discoverable” config and followed the steps in the how-to. For MacOS Ventura 13.1, the latest is OpenSSH_9.1p1, OpenSSL 1.1.1s, so you can generate the key with ecdsa-sk.<\/p>\n

The second specific that is not well covered in the Yubico how-to is the server config.<\/p>\n

– For Debian 11.6 (with OpenSSH_8.4p1 Debian-5+deb11u1, OpenSSL 1.1.1n) add the following in your \/etc\/ssh\/sshd_config<\/p>\n

#Yubikey FIDO authentification
\nPubkeyAuthentication yes
\nPubkeyAuthOptions verify-required
\nPubkeyAcceptedKeyTypes ssh-ed25519,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com<\/p>\n

you also need to disable PAM in the config with:
\nUsePAM no<\/p>\n

– for OpenBSD 7.2 (with OpenSSH_9.1, LibreSSL 3.6.0) is the same, but it works even if you comment the PAM option:<\/p>\n

#Yubikey FIDO authentification
\nPubkeyAuthentication yes
\nPubkeyAuthOptions verify-required
\nPubkeyAcceptedKeyTypes ssh-ed25519,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com
\n#UsePAM no<\/p>\n

I have added the options ssh-ed25519,sk-ssh-ed25519 to PubkeyAcceptedKeyTypes because I have several Yubikeys with different firmware versions, and several generated keys types. For Yubikey with NFC support and firmware 5.4.3 I just need sk-ecdsa-sha2-nistp256.<\/p>\n

Limitations:
\n– you need the Yubikey all the time (obviously). BUT if you need to login to a bastion A for example, and from the bastion A to another host B, you can not do it with this setup. You can do the config on your local client and your bastion A with the above setup, but you can not do it on host B thru a bastion. Because when you login in bastion A, you lose the Yubico verification (PIN and touch) as the ssh can not “see” your Yubikey plugged on your local client.
\n– you better have two Yubikeys in case you lose your primary one.<\/p>\n","protected":false},"excerpt":{"rendered":"

Yubikey is my preferred solution for securing social account (Twitter, Facebook, Google), WordPress admin accounts, Git, Apple ID (since the iOS 16.3, and you need two keys) and OpenSSH (since v 8.2p1). The Yubico how-to is great, I will just add couple of specifics on configuring the server and the clients. I chose the “discoverable” […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-69","post","type-post","status-publish","format-standard","hentry","category-security","category-yubikey"],"yoast_head":"\nYubikey for ssh authentication with FIDO2 - dilyan.be<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dilyan.be\/?p=69\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Yubikey for ssh authentication with FIDO2 - dilyan.be\" \/>\n<meta property=\"og:description\" content=\"Yubikey is my preferred solution for securing social account (Twitter, Facebook, Google), WordPress admin accounts, Git, Apple ID (since the iOS 16.3, and you need two keys) and OpenSSH (since v 8.2p1). The Yubico how-to is great, I will just add couple of specifics on configuring the server and the clients. I chose the “discoverable” […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dilyan.be\/?p=69\" \/>\n<meta property=\"og:site_name\" content=\"dilyan.be\" \/>\n<meta property=\"article:published_time\" content=\"2023-02-05T10:53:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-03-31T08:31:05+00:00\" \/>\n<meta name=\"author\" content=\"dilyan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"dilyan\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dilyan.be\\\/?p=69#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dilyan.be\\\/?p=69\"},\"author\":{\"name\":\"dilyan\",\"@id\":\"https:\\\/\\\/dilyan.be\\\/#\\\/schema\\\/person\\\/5d995599960773a9e6162910b0fb6c6d\"},\"headline\":\"Yubikey for ssh authentication with FIDO2\",\"datePublished\":\"2023-02-05T10:53:36+00:00\",\"dateModified\":\"2023-03-31T08:31:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dilyan.be\\\/?p=69\"},\"wordCount\":331,\"articleSection\":[\"Security\",\"Yubikey\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dilyan.be\\\/?p=69\",\"url\":\"https:\\\/\\\/www.dilyan.be\\\/?p=69\",\"name\":\"Yubikey for ssh authentication with FIDO2 - dilyan.be\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/dilyan.be\\\/#website\"},\"datePublished\":\"2023-02-05T10:53:36+00:00\",\"dateModified\":\"2023-03-31T08:31:05+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/dilyan.be\\\/#\\\/schema\\\/person\\\/5d995599960773a9e6162910b0fb6c6d\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dilyan.be\\\/?p=69#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dilyan.be\\\/?p=69\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dilyan.be\\\/?p=69#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/dilyan.be\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Yubikey for ssh authentication with FIDO2\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/dilyan.be\\\/#website\",\"url\":\"https:\\\/\\\/dilyan.be\\\/\",\"name\":\"dilyan.be\",\"description\":\"Dilyan Berkovski's site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/dilyan.be\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/dilyan.be\\\/#\\\/schema\\\/person\\\/5d995599960773a9e6162910b0fb6c6d\",\"name\":\"dilyan\",\"sameAs\":[\"https:\\\/\\\/dilyan.be\"],\"url\":\"https:\\\/\\\/dilyan.be\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Yubikey for ssh authentication with FIDO2 - dilyan.be","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dilyan.be\/?p=69","og_locale":"en_US","og_type":"article","og_title":"Yubikey for ssh authentication with FIDO2 - dilyan.be","og_description":"Yubikey is my preferred solution for securing social account (Twitter, Facebook, Google), WordPress admin accounts, Git, Apple ID (since the iOS 16.3, and you need two keys) and OpenSSH (since v 8.2p1). The Yubico how-to is great, I will just add couple of specifics on configuring the server and the clients. I chose the “discoverable” […]","og_url":"https:\/\/www.dilyan.be\/?p=69","og_site_name":"dilyan.be","article_published_time":"2023-02-05T10:53:36+00:00","article_modified_time":"2023-03-31T08:31:05+00:00","author":"dilyan","twitter_card":"summary_large_image","twitter_misc":{"Written by":"dilyan","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dilyan.be\/?p=69#article","isPartOf":{"@id":"https:\/\/www.dilyan.be\/?p=69"},"author":{"name":"dilyan","@id":"https:\/\/dilyan.be\/#\/schema\/person\/5d995599960773a9e6162910b0fb6c6d"},"headline":"Yubikey for ssh authentication with FIDO2","datePublished":"2023-02-05T10:53:36+00:00","dateModified":"2023-03-31T08:31:05+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dilyan.be\/?p=69"},"wordCount":331,"articleSection":["Security","Yubikey"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.dilyan.be\/?p=69","url":"https:\/\/www.dilyan.be\/?p=69","name":"Yubikey for ssh authentication with FIDO2 - dilyan.be","isPartOf":{"@id":"https:\/\/dilyan.be\/#website"},"datePublished":"2023-02-05T10:53:36+00:00","dateModified":"2023-03-31T08:31:05+00:00","author":{"@id":"https:\/\/dilyan.be\/#\/schema\/person\/5d995599960773a9e6162910b0fb6c6d"},"breadcrumb":{"@id":"https:\/\/www.dilyan.be\/?p=69#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dilyan.be\/?p=69"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dilyan.be\/?p=69#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/dilyan.be\/"},{"@type":"ListItem","position":2,"name":"Yubikey for ssh authentication with FIDO2"}]},{"@type":"WebSite","@id":"https:\/\/dilyan.be\/#website","url":"https:\/\/dilyan.be\/","name":"dilyan.be","description":"Dilyan Berkovski's site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/dilyan.be\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/dilyan.be\/#\/schema\/person\/5d995599960773a9e6162910b0fb6c6d","name":"dilyan","sameAs":["https:\/\/dilyan.be"],"url":"https:\/\/dilyan.be\/?author=1"}]}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dilyan.be\/index.php?rest_route=\/wp\/v2\/posts\/69","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dilyan.be\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dilyan.be\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dilyan.be\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dilyan.be\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=69"}],"version-history":[{"count":2,"href":"https:\/\/dilyan.be\/index.php?rest_route=\/wp\/v2\/posts\/69\/revisions"}],"predecessor-version":[{"id":85,"href":"https:\/\/dilyan.be\/index.php?rest_route=\/wp\/v2\/posts\/69\/revisions\/85"}],"wp:attachment":[{"href":"https:\/\/dilyan.be\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=69"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dilyan.be\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=69"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dilyan.be\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=69"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}