Arduino FIDO2 Authenticator

Re:Arduino FIDO2 Authenticator by StavrosK on Monday June 29, 2020 @11:00AM (#23678205)

Oh, it's just U2F? You want FIDO2 with resident key support to get the really nice OpenSSH workflow (plug the key in to a new computer, run ssh-add -k, now you can SSH to all your computers).

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by alias_neo on Monday June 29, 2020 @11:22AM (#23678416)

Can I do this with a Yubikey?

Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything?

I think I was using PIV last time.

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by StavrosK on Monday June 29, 2020 @11:27AM (#23678470)

Yes you can, SSH 8.3ish uses FIDO2 and doesn't do anything Yubikey-specific. That means you don't have to bother with all the agent stuff, and it works with any dirt-cheap FIDO2 key.

EDIT: I'm going to post a writeup tomorrow detailing how to do this, because it's wonderful and super secure.

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by alias_neo on Monday June 29, 2020 @11:44AM (#23678611)

Thanks, going to look into it more tonight, see if I can get a 5C setup.

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by StavrosK on Monday June 29, 2020 @11:48AM (#23678643)

It is literally just the two commands, I can send them to you when I'm at the pc. I have a 5C too.

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by alias_neo on Monday June 29, 2020 @12:00PM (#23678781)

That'd be great, thanks. I'll have to do a follow up to my blog post: [SSH 2-Factor's First Factor](https://2byt.es/post/totp2/) once I've had a play.

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by ta17711771 on Tuesday June 30, 2020 @12:41AM (#23686634)

Have Nitro keys on the way. Looking forward to your writeup, mate.

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by StavrosK on Tuesday June 30, 2020 @11:19AM (#23690940)

It is here! https://news.ycombinator.com/item?id=23689499

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by tialaramex on Monday June 29, 2020 @11:30AM (#23678491)

Yes, any vaguely modern YubiKey implemented FIDO2 which is what you need.

However you need fairly modern OpenSSH (this year) for both clients and servers. Both need to be upgraded because the authentication protocol itself is different, so an older server has no idea how to authenticate with FIDO2.

To get the behaviour the parent describes you must make sure to follow the instructions for resident keys, and these instructions won't work on cheaper FIDO (not FIDO2) devices that designed be used as second factors. Without resident keys the authenticator only works when at the computer you used to enrol it, which is fine for a personal workstation/ laptop but not great if you need to roam.

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by alias_neo on Monday June 29, 2020 @11:44AM (#23678600)

Thanks, I have a few 5C's so they should be new enough, I'll need to check my laptop/desktop to make sure SSH is new enough (I run Ubuntu 20.04/Manjaro respectively).

My servers most likely aren't, but I run most of my workloads in Docker or Kubernetes so it's just a matter of time to get them all updated.

[ Parent | on HN ]

Re:Arduino FIDO2 Authenticator by StavrosK on Monday June 29, 2020 @11:44AM (#23678601)

Not strictly true, you can copy the "private" key (just a pairing file for the dongle) around and still use the USB key fine with it.

[ Parent | on HN ]