Hacker News Reader

Comment by traceroute66 | Hacker News Reader

I've used public-key basically forever.

I have wanted to go that step further and implement certificates for a good few years now, I absolutely see the value, no question about it (i.e. no more out of date authorized_keys files, no need to even install authorized_keys files in the first place, the list goes on).

I wish YubiKeys were more flexible in allowing SSH certificates to be hosted on them (currently can only host X509 type). Because if I could use a Yubi for SSH certificate signing I would have already been using certificates ! (Yes I know, theoretically you can do it with GPG keys, but frankly that's a PITA with many issues).

My current plan is to take inspiration from this : https://smallstep.com/blog/diy-single-sign-on-for-ssh/

View on HN

You can use this great-but-also-terrible system to do X509 certificate validation with SSH: https://github.com/mjg59/ssh_pki Maybe after some deeper security analysis this idea could help you work around the limitations of Yubikey's hardware.

However, if the author of a piece of security software tells me something is a bad idea, I tend to accept that, especially if that author is mjg59.

@jeroenhd Mea-culpa, had a choice of two smallstep bookmarks and I copy/pasted the wrong one ! Now corrected.

As an alternative, you might consider using an ed25519-sk ssh key so you can use your YubiKey as a second factor during authentication. I've got my keys loaded up in the SSH agent by KeepassXC when I open my database and can log in to a box just by pressing my YubiKey. No keys on disk, no passwords to remember (except your Keepass master key ofcourse).

Would love to know more about this workflow!

It's pretty much a combination the following:

- https://keepassxc.org/docs/#faq-ssh-agent-how

- https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

You could probably also put the SSH key itself as a resident key on the YubiKey. But personally I like the fact the key and 2FA aren't on the same device (and the fact you can only get my key when you know the KeepassXC master password).

The Yubikey PIV/X509 applet can be used for SSH (see [0]). Their link doesn't explain this but that key can be used as a CA instead of as a straight SSH key if you want. eg to add the CA to your authorized_keys files, generate a throwaway key, sign that with the CA and add it to your ssh-agent:

  ssh-keygen -D opensc-pkcs11.so -e > cert-on-piv.ssh
  ( echo -n "cert-authority "; cat cert-on-piv.ssh ) >> ~/.ssh/authorized_keys
  name="temp-$(date +%Y%m%d-%H%M)"
  ssh-keygen -q -N '' -C "${name}" -t rsa-sha2-256 -f ${name}
  ssh-keygen -t rsa-sha2-256 -s cert-on-piv.ssh -D opensc-pkcs11.so -V -1d:+1d -I ${name} ${name}.pub
  ssh-add -t 1d ${name}
  rm -f ${name} ${name}.pub ${name}-cert.pub

[0] https://developers.yubico.com/PIV/Guides/PIV_Walk-Through.ht...

You can sign yubikey-hosted FIDO keys in OpenSSH just fine.

A FIDO token can also act as CA, though the certificates it issues will be limited to use by relatively recent SSH versions as FIDO support was only added in 2019.

using yubikeys in fido2 as the CA key just works, and the cert is its public key

what doesn't work is storing the signed certificates

Reply on news.ycombinator.com