Configuring SSH FIDO U2F Authentication with YubiKey

Forum post write up

How To Generate Ed25519 SSH Keys, Install Them, and Configure Secure Passwordless Authentication

LearnLinuxTV YubiKey Video

CVE-2021-3011

Connecting With Us
---------------------------------------------------

Lawrence Systems Shirts and Swag
---------------------------------------------------

AFFILIATES & REFERRAL LINKS
---------------------------------------------------
Amazon Affiliate Store

UniFi Affiliate Link

All Of Our Affiliates that help us out and can get you discounts!

Gear we use on Kit

Use OfferCode LTSERVICES to get 5% off your order at

Digital Ocean Offer Code

HostiFi UniFi Cloud Hosting Service

Protect you privacy with a VPN from Private Internet Access

Patreon

⏱️ Timestamps ⏱️
00:00 FIDO2 SSH Yubikey
01:10 Check SSH Vestion & Yubikey Version
02:40 install libfido2-dev
03:18 Generating ed25519-sk keys
05:36 Installing & Using the Keys
07:00 Cloning Keys?
#FidoU2F #Yubikey #SSH

[LAWRENCESYSTEMS]

Forum post write up

LearnLinuxTV YubiKey Video

CVE-2021-3011


⏱ Timestamps ⏱
00:00 FIDO2 SSH Yubikey
01:10 Check SSH Vestion & Yubikey Version
02:40 install libfido2-dev
03:18 Generating ed25519-sk keys
05:36 Installing & Using the Keys
07:00 Cloning Keys?

[cloudcultdev]

“Feel free to flame me in the comments for doing things as root” - now that’s a seasoned YouTuber who knows their audience well! Great video once again, Tom!

[JasonsLabVideos]

Good video sir ! I use the UB-C version for my phone & laptops. These things are amazing & durable too !!

[daveemmons]

I really enjoy your videos, technical enough to make things happen with simple enough explanations that I can understand what is going on.


Thanks again!

[NicholasOrr]

Thanks for the info - this is very sensible and simple now days.
only thing that stops me from using yubikey for constant auth is needing to plug in the device :P
need to get a cable to move the USB ports closer to my keyboard

[omfghaiu]

A good idea to get two keys since some sites that uses fido2 only supports another key as the backup login method. (or their other backup is "less than secure")

[bobtatar]

Tom – thanks for the video. I think you will want to encourage viewers to use pass phrases with their hardware keys. It’s a lot easier to steal a hardware device than a passphrase, and if somebody has the device to get into your servers, they will be very glad that you did not protect it with a passphrase.

[steinerviana]

Thanks for the video. Can I use yubikey with Radius server in pfsense?

[BrianThomas]

Fantastic video. Can you do the same thing with PF sense? You do a video that shows Just working with PFSENSE

[austin]

I am kind of late 😂…. But how do I configure multiple YubiKeys (main+backups)? I just have to generate one shh key for each u2f key with a different name and thats all?

[bardus_hobus]

What if I lost the key on the client host? Is there a way to generate it back using just the hardware key?

[jacobhenriksen]

Does this work with nested ssh sessions? I usually ssh from my windows machine into my pop-os vm, and from there I can run tmux and ssh into my other linux servers.

[craigstone]

Lawrence. Big fan of the content. Regarding the advice "get a second key and store it in a safe deposit box" how does that work? You can't enroll the second key as a backup for a service if its locked up at a remote location. To me the second key just becomes stale from the second you enroll the first key in another service. Am I missing something?

[jessedyson]

Thank you for putting this video together. I do have one question about the ssh-keygen command. Does this command overwrite anything on the YubiKey? The reason for the question is that I have an existing YubiKey that I’m using for FIDO2 and I don’t want to break it.🙂

[simons]

This method is very effective for security devices and even web page. Personally I like to use Google Authentication or Microsoft Authentication app on my phone, this way I don't have to carry e, tea items. Lawrence, do you know any good software that can integrate Authentication app with ssh or OpenVPN?

[philippe_demartin]

Would it be possible to create a kind off security token from a standart thumb drive ?
Shure, you can mont you thumb drive, who contain your key, on you ~/.ssh folder, but is there another trick to combine both "private key" and "thumb drive residente" part of the autentification?

[CaptZenPetabyte]

It would be nice to have a way to do this with a USB drive in some way, but I know thats not possible because the electronics is required; maybe a raspberry pi zero or pico could do the job and then you would also have even more 'playing around' space for interesting 'active encryption response'. (just brainstorming ideas)

[danimoosakhan]

Can i use multiple ed25519-sk with same Yubikey. Will it override the previous keys?

[shaung]

Is there any practical difference between ecdsa-sk and ed25519-sk in this application? I can get ecdsa-sk to work with my hardware key but so far have been unsuccessful with ed25519-sk.

[aasd]

Don't these have to send a request to the Yubikey's servers each time an auth attempt is made?