Hacker News Reader

Comment by zegl | Hacker News Reader

If the yubikey dies, either another person can provision your replacement, or a configuration management system can do so.

We’re doing this successfully where I’m working.

View on HN

I'm not sure I understand what you mean. I run a one-person business and my servers are 110 miles away in Sacramento; what do I do if my yubikey breaks?

I think the SOP is to have a second Yubikey registered and stored in a safe place and/or a set of one-time codes that you can use instead.

I actually had no idea SSH had support for one-time passwords, but I see docs for OTPW here: https://www.digitalocean.com/community/tutorials/install-and...

This looks like exactly the answer I needed; thank you!

It sounds like you're trying to do something like Yubikey OTP or U2F with SSH. Both are doable, but I don't think that's the normal way people use hardware tokens with SSH; what I've seen much more is that people use Y4 keys (which are basically pocket HSMs), generate RSA keypairs with them, and configure SSH to accept the public key on the token.

This doesn't require any support on the serverside; as far as the server's concerned, the Y4 is just another RSA key.

It does require the more expensive Yubikey, but there are some security advantages to using it.

No, my thinking is along the lines of what you're describing (generate the key on the Y5 Yubikey so that it never leaves it). The discussion of one-time stuff is just as backup for scenarios where I lose the key, which I invariably will, or need to give other people "break glass in case of emergency" access to the servers.

> something like Yubikey OTP or U2F with SSH. Both are doable

I would be interested in how you think U2F with SSH is doable. Maybe with a custom SSH server and client?

Have you actually see this done in anger?

ssh server trusts internal CA, an application that requires U2F login can issue 5 minute certificates signed by the CA, the ssh session does not close when the login cert expires. See https://github.com/Netflix/bless and https://github.com/gravitational/teleport

You should already have a full backup of your (private) RSA key anyway on an encrypted USB drive in a desk drawer somewhere, so you use that until you can provision a new Yubikey.

Reply on news.ycombinator.com