yubikey-agent is an easy to use Go ssh-agent for YubiKeys

栏目: IT技术 · 发布时间: 4年前

内容简介:yubikey-agent is a seamless ssh-agent for YubiKeys.Written in pure Go, it's based on

yubikey-agent

yubikey-agent is a seamless ssh-agent for YubiKeys.

  • Easy to use. A one-command setup, one environment variable, and it just runs in the background.
  • Indestructible. Tolerates unplugging, sleep, and suspend. Never needs restarting.
  • Compatible. Provides a public key that works with all services and servers.
  • Secure. The key is generated on the YubiKey and can't be extracted. Every session requires the PIN, every login requires a touch. Setup takes care of PUK and management key.

Written in pure Go, it's based on github.com/go-piv/piv-go and golang.org/x/crypto/ssh .

yubikey-agent is an easy to use Go ssh-agent for YubiKeys

Installation

macOS

brew tap filippo.io/yubikey-agent https://filippo.io/yubikey-agent
brew install yubikey-agent
brew services start yubikey-agent

yubikey-agent -setup # generate a new key on the YubiKey

Then add the following line to your ~/.zshrc and restart the shell.

export SSH_AUTH_SOCK="/usr/local/var/run/yubikey-agent.sock"

Advanced topics

Conflicts with gpg-agent and Yubikey Manager

yubikey-agent takes a persistent transaction so the YubiKey will cache the PIN after first use. Unfortunately, this makes the YubiKey PIV and PGP applets unavailable to any other applications, like gpg-agent and Yubikey Manager. Our upstream is investigating solutions to this annoyance .

If you need yubikey-agent to release its lock on the YubiKey, send it a hangup signal. Likewise, you might have to kill gpg-agent after use for it to release its own lock.

killall -HUP yubikey-agent

This does not affect the FIDO2 functionality.

Unblocking the PIN with the PUK

If the wrong PIN is entered incorrectly three times in a row, YubiKey Manager can be used to unlock it.

yubikey-agent -setup sets the PUK to the same value as the PIN.

ykman piv unblock-pin

If the PUK is also entered incorrectly three times, the key is permanently irrecoverable. The YubiKey PIV applet can be reset with yubikey-agent -setup --really-delete-all-piv-keys .

Manual setup and technical details

yubikey-agent only officially supports YubiKeys set up with yubikey-agent -setup .

In practice, any PIV token with an RSA or ECDSA P-256 key and certificate in the Authentication slot should work, with any PIN and touch policy.

yubikey-agent -setup generates a random Management Key and stores it in PIN-protected metadata . Note that this is a different scheme from the ykman one, which enables PIN bruteforcing.

Alternatives

Native FIDO2

Recent versions of OpenSSH support using FIDO2 tokens as keys . Since those are their own key type, they require server-side support, which is currently not available in Debian stable or on GitHub.

FIDO2 keys also usually don't require a PIN, but depending on the token can require a private key file. yubikey-agent keys can be ported to a different machine simply by plugging in the YubiKey.

gpg-agent

gpg-agent can act as an ssh-agent , and it can use keys stored on the PGP applet of a YubiKey.

This requires a finicky setup process dealing with PGP keys and the gpg UX, and seems to lose track of the YubiKey and require restarting all the time. Frankly, I had enough of PGP and GnuPG.

ssh-agent and PKCS#11

ssh-agent can load PKCS#11 applets to interact with PIV tokens directly. There are two PKCS#11 providers for YubiKeys: OpenSC and ykcs11.

The UX of this solution is poor: it requires calling ssh-add to load the PKCS#11 module and to unlock it with the PIN (as the agent has no way of requesting input from the client during use, a limitation that yubikey-agent handles with pinentry ), and needs manual reloading every time the YubiKey is unplugged or the machine goes to sleep.

The ssh-agent that ships with macOS (which is pretty cool, as it starts on demand and is preconfigured in the environment) also has restrictions on where the .so modules can be loaded from. It can see through symlinks, so a Homebrew-installed /usr/local/lib/libykcs11.dylib won't work, while a hard copy at /usr/local/lib/libykcs11.copy.dylib will.

Secure Enclave

On macOS systems with a Secure Enclave, it would make even more sense to generate the keys on there, use Touch ID for confirmation, and maybe even show the host being authenticated to on the Touch Bar.

There is a project experimenting with that at github.com/rolandshoemaker/sesa , but unfortunately compiling software for the Secure Enclave requires specific entitlements from Apple, which complicates development.

pivy-agent

pivy-agent is part of a suite of tools to work with PIV tokens. It's similar to yubikey-agent , and inspired its design.

The main difference is that it requires unlocking via ssh-add -X rather than using a graphical pinentry, and it caches the PIN in memory rather than relying on the device PIN policy. It's also written in C.

yubikey-agent also aims to provide an even smoother setup process.


以上就是本文的全部内容,希望对大家的学习有所帮助,也希望大家多多支持 码农网

查看所有标签

猜你喜欢:

本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们

智慧社会

智慧社会

阿莱克斯·彭特兰 (Alex Pentland) / 汪小帆、汪容 / 浙江人民出版社 / 2015-4 / CNY 56.90

●如果要在大数据领域推举出一个代表性的科学家,阿莱克斯·彭特兰是一个无法令人忽略的名字。经过数年极具开创性的研究,社会物理学这个全新科学领域的根基已足够深厚。社会物理学是关于想法流的科学,正是在想法流的帮助下,我们才得以提高集体智能,促进智慧社会的形成。 ● 通过研究数以百万计的人在智能手机、GPS设备、互联网等地方留下的“数字面包屑”,大数据的应用已成为一股无法被忽视的力量。在大数据的应用......一起来看看 《智慧社会》 这本书的介绍吧!

JSON 在线解析
JSON 在线解析

在线 JSON 格式化工具

URL 编码/解码
URL 编码/解码

URL 编码/解码

html转js在线工具
html转js在线工具

html转js在线工具