Hacker News new | ask | show | jobs
by drdaeman 3079 days ago
I don't know about Yubikeys, but with FST-01 SSH (via gpg-agent, essentially same setup as the linked article) just works. Using this for half an year and no complaints.

Sometimes it doesn't immediately see the key after reboot and I need to plug it out and plug back in. I think this usually happens when I dual-boot and switch between different OSes, as same-OS reboots are usually OK. Haven't exactly paid attention, though. I rarely reboot my desktop machine and I don't keep the key plugged into laptops.

Also, very rarely gpg-agent gets stuck and I have to KILLAGENT /bye. But I think that happens, maybe, once in 2 months or so. Docker (just a random example) gives me more headache.

2 comments

I fixed most of my problem with the following command after plugging the key (Win and Linux):

`gpg --card-status` then wait for key status

That command starts everything related to GPG/SSH (daemon/agent).

This is essentially a diagnostic command, not really a fix ;)

For me, when gpg-agent gets "stuck", this command just fails. I forgot the exact message but it tells me that it can't find the device. `gpg-connect-agent KILLAGENT /bye` and then `gpg --card-status` (will automatically start a new gpg-agent daemon in the background) does the trick for me, but it's the first command that matters.

(Could be just `killall gpg-agent`, I guess)

Oh, I think on Windows, once I had to restart the Smartcards service, as restarting the agent haven't helped. Don't know what it was - I've experimented with OpenSC around that time so could be just about anything.

Where do you even find a FST-01 these days? (Besides building your own) It seems that they are no longer being made :(
The NitroKey Start uses the same CPU (IIRC) and also runs the open gnuk firmware.

https://www.nitrokey.com/products/nitrokey-start