Hacker News Reader

Comment by nixpulvis | Hacker News Reader

What I kinda want is a way to use a detachable hardware key like a Yubikey as a primary factor for SSH and login authentication. I have multiple computers and I provision new OSes frequently and I always find it irritating depending on either network or flash drive synchronization for secret material when I could just be plugging in a smartcard device.

Anyone gone down this path?

View on HN

GPG keys are one option, but only recommended if you need compatibility. Having to deal with GPG + GPG agent is enough to make them a pain to use.

The modern way is SSH resident keys. However, this requires a “modern” SSH version (8.2), but does not add a dependency on GPG. Modern in this case, is a version from 2020.

See my other comment for why I don't think SSH resident keys accomplish what I'm looking for. I'll have to experiment with using gpg-agent a bit, that sounds promising although potentially irritating to configure cross platform.

You don’t need a file on the client for resident keys. You have to run a command to load them into the SSH agent, but you don’t need any information for that.

https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

Ahhhh. The key thing I was missing was `ssh -K`. This works, but isn't really quite what I was hoping for. It's effectively using the SK as a glorified flash drive to transfer the secret key. I was kinda hoping to avoid storing the private key on the local machine at all. There are upsides to this strategy however, especially given how simple it is and how it maintains compatibility with tools which require secret key material directly.

I may end up using a mix of this and a GPG integration once I learn more about how that works with SSH. I still need to dig into PIV/PAM/Keychain/FileVault/etc...

Thanks for the top though :)

I’m not sure, but I’d be surprised if the secret key leaves the SK. If you remove it, SSH doesn’t work. `-K` configures a pointer so SSH knows where to look to find the private key (on the SK). It is the same as non-resident keys, but stores the private key pointer on the SK as well.

> I was kinda hoping to avoid storing the private key on the local machine at all.

I may be misunderstanding but I use U2F with OpenSSH (8.3). The private key is not on the local machine. It's still SSH public/private key pair but the private key on the computer is only a "key handle", not the real private key. The private key is protected on the security key. I don't mind copying that private key around: although it looks like a private key, it's just a key handle and not the actual private key.

Good point. I'm not being precise, sorry.

Still, I'm trying to avoid leaving so many breadcrumbs on my systems if they aren't needed.

Not using SSH resident keys myself yet, but you also require key identifiers for your gpg keys on the local machine if you use yubikeys with gpg afaik.

Ugh, now I'm having the dreaded ERROR: Failed to connect to YubiKey when running ykman fido info. :(

Of all the tech stacks that I have to deal with on a daily basis, I just don't get how GPG is hard. It is just like any other tool.

But, I just copy my ~/.gnupg directory to my new machine or to some backup server and all my gpg backed ssh keys/configs are portable. It's not terribly hard.

IMO, GPG has a pretty terrible CLI. GPG agent config is complicated and is more of a pain to get working with forwarding etc. I don’t like the fact that GPG requires config at all. I also have no use for it, that I can’t solve with something nicer. I use age/sops for my encryption-related use cases. If I needed signing, I’d probably use minisign or signify. For authentication, Wireguard/SSH.

But for the SSH key use case, none of this matters. Unless you need compatibility with old SSH servers/clients, resident keys are substantially simpler, because they cut out 1 tool entirely and don’t require copying any directories to other machines.

I get it. The man pages for GPG are like reading War And Peace, whereas the man pages for Age is easily digestible. I too use Age for certain things, but have to use GPG in some of my workflows. But I find it no harder than some insane Helm chart values.yaml files, or some crazy assed Terraform runs with a tfvars file that has hundreds of lines to merely spin up a bucket or vpc. It's just another tool that you need to config and understand.

> But for the SSH key use case, none of this matters.

Agreed.

You can use the security-key variants of ssh keys. Those would be ecdsa-sk, ed25519-sk and others[0]. This does require a newer OpenSSH version to work. GitHub has added support for these keys back in 2021.

[0]: https://news.ycombinator.com/item?id=22324074

[1]: https://github.blog/2021-05-10-security-keys-supported-ssh-g...

This is possible with PGP Keys stored on the Yubikey and used as the SSH keys. Check the Repo of drduh as a starting point

https://github.com/drduh/YubiKey-Guide#ssh

Correct me if I'm wrong or missing something, but doesn't the use of SSH resident keys still require a file to be present on the client before it can authenticate? I'm prompted to use the SK to prove my 'presence' after the standard identity secret keyfile is checked.

To be clear, my goal is to simply plug in my SK to a fresh OS install and "magically" be able to SSH into my servers.

That’s how it works for me. I generated a new key on the device, installed the public key where appropriate, and tap to authenticate.

https://support.apple.com/en-us/HT208372

https://playbooks.idmanagement.gov/piv/engineer/ssh/

Maybe not “magic” but you can get very close to that with “Discoverable Credentials” on a FIDO2 key.

The process for using a discoverable key on a new machine re-imports the relevant public key and private key handle to the new machine when you “ssh-keygen -K”. Its roughly equivalent to copying key material around with a flash drive, but without the need to remember two physical items.

Look up ssh -sk keys. OpenSSH has been supporting FIDO2 secured keys for quite a while now. You're specifically looking for "resident" keys.

YubiKey already supports those scenarios, I think.

What real security risk is it mitigating tho?

Um... it replaces a password (or manual management of keys) with a USB device I can carry around like a proper key.

You described what it does and missed the point of my question. What real security risk is it being handled?

A hacker who got into your laptop can’t simply copy your id_rsa file to get further access to all your servers, it’s physically stored in the usb dongle with no way to get it out and requires physically touching it each time key is used.

A hacker who got into your laptop can piggy back on your SSH connections (and also extract all sort of vital data).

Not being able to extract SSH keys helps very little.

Helps more than you might think! Because the other thing Secretive can do is require touch ID for each use of the key. Similarly, you can require a button push from your yubikey.

Reply on news.ycombinator.com