Poll HN: Do you use SSH certificates (not mere public-key authentication)?

Re:Poll HN: Do you use SSH certificates (not mere public-key... by XiS on Wednesday August 31, 2022 @09:26AM (#32661790)

As an alternative, you might consider using an ed25519-sk ssh key so you can use your YubiKey as a second factor during authentication. I've got my keys loaded up in the SSH agent by KeepassXC when I open my database and can log in to a box just by pressing my YubiKey. No keys on disk, no passwords to remember (except your Keepass master key ofcourse).

[ Parent | on HN ]

Re:Poll HN: Do you use SSH certificates (not mere public-key... by tomaslaureano on Wednesday August 31, 2022 @10:25AM (#32662436)

Would love to know more about this workflow!

[ Parent | on HN ]

Re:Poll HN: Do you use SSH certificates (not mere public-key... by XiS on Wednesday August 31, 2022 @11:34AM (#32663533)

It's pretty much a combination the following:

- https://keepassxc.org/docs/#faq-ssh-agent-how

- https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

You could probably also put the SSH key itself as a resident key on the YubiKey. But personally I like the fact the key and 2FA aren't on the same device (and the fact you can only get my key when you know the KeepassXC master password).

[ Parent | on HN ]