Hardened security and passwordless login with ed25519 SSH keys

ed25519 SSH keys are finally here and Druvis will show you how to make use of them.

Note: Private key import functionality is still in development and the custom OpenSSH key format (used by ssh-keygen) might not get implemented for the ed25519 key type.

0:00 Intro
0:48 Host key explained
02:00 ed25519 host key
02:19 strong-crypto explained
03:09 ed25519 user key
04:16 Outro

[AlexanderNecheff]

25519 uses a fixed key size so the `-b` argument to `ssh-keygen` will be ignored, FYI.

[markdudov]

More and more you raise the status of the video. Well done!

[YoSi]

When will Ed25519-sk keys be able to be used?
Combined with Yubikey, this provides even greater security

[Andre-jjxs]

I'd love to see a better error reporting for failed (key) imports. It took me a while to see why import of my public key (and CA intermediate certificates) failed without an error message.
My file was \r\n (windows) encoded instead of \n (linux)

[pavelsmarhels]

When winbox will support passwordless auth?

[gg-gnre]

amazing, been using these exclusively for 10 years, never knew people were so insanely slow they didn't actually have it available already.

[samerkabalan]

What about more care about url filtering, dns filtering, DPI

[ryandekock]

Well i think the real question is, how do you do this on +-2000 routers and add remove users public keys on staff rotation/key compromised etc. These videos are awesome, but doing things for 1 user and 1 router is not the same as managing a fleet or routers and a staff base

[njmpkow]

When will the support for ed25519 be available for generating certificates and IKEv2?

[feicodeboer]

"If you're paranoid, you check it ..." Anyone ever did that?

[hefrcku]

hello, is there any resource on hoe to sign a message using ed25519 keys in cpp?

[user_-lg]

We need support for 25519 for certificates and IKEv2

[tim_the_grim]

Mr Druvis - great video overall, but you left out a very important step.

How do you verify host key fingerprint from RouterOS?
When connecting via an external SSH client, it says:
"The authenticity of host ... can't be established. The fingerprint is ..."

No, it is not just the paranoid that should be checking this.
We should be recommending good security practises.

[JoseMedina-irzi]

Are any plans in the future for a native linux Winbox app?

[Graham_Rule]

Before I do all that, can you tell me how I get back in when I've screwed up and locked myself out? Not saying that I'm going to do that but I'm the sort of person who saws a branch of a tree while standing on it. 😂

[javierhorrillo]

when exporting host key, only private part is exported as PEM format, when using ed25519 host key type at /ip/ssh configuration. Is this intentional? How can I import public key then in another router, for allowing a main router to act as a password-less client for a different router? (as explained in your first video regarding ssh keys)