[dboreham]

I've waited 10 years for this.

[StavrosK]

Same here, and I just absolutely love how well it works. Now if Android SSH apps add support for it, my SSH life will be complete.

[ta17711771]

Can you do it with Termux or T-UI somehow? Addons?

[StavrosK]

Hmm, I don't think so, but I'll look into it, thanks!

[xaduha]

Should've asked around, there were devices, standards and software for this kind of thing for a while e.g. https://github.com/philipWendland/IsoApplet

[knorker]

Waited 10 years? Why didn't you just use a yubikey in PIV mode, or the yubikey with gpg, or a smartcard, or… I've been using a yubikey PIV for, hmm… at least 5 years.

Sure, a FIDO key is cheaper.

[xaduha]

BTW both PIV and GPG in Yubikeys are just applets and not particularly suited for SSH use either. Proper applet for it is this one https://github.com/philipWendland/IsoApplet, if you can install it of course.

Some get confused or have bad associations when hearing the word 'applet', but that is what they are, as in 'Java applet'.

This one is too https://developers.yubico.com/ykneo-oath/Releases/

[knorker]

What makes you say it's not particularly suited for SSH?

[xaduha]

Because they were made for a different purpose, with extra hoops you need to jump through.

[knorker]

U2F was made for a different purpose too.

I don't see what's so extra hoop-y about telling SSH "use key from industry standard PKCS#11". That's literally what it's there for, and when Yubico added PIV support that instantly added support to multiple operating systems (incl Linux & Windows) where SSH keys "just work".

I can take a yubikey today from my Linux system, plug it into a Windows machine, and Putty with wincrypt support "just works". Because that's how it was designed.

[xaduha]

You're using yubikey agent or ykcs11 or yubico-piv-tool or somesuch nonsense most likely that actually provides PKCS#11. That is it wraps whatever PIV is supposed to do and gives you PKCS#11 interface. I'm talking about something that isn't Yubico specific and provides PKCS#11 and PKCS#15 with OpenSC straight ootb.

e.g. issues that described here are avoided https://github.com/FiloSottile/yubikey-agent#alternatives

[closeparen]

OpenSSH doesn't do X.509, how would PIV mode or a smartcard help?

[Xylakant]

Yubikeys work in PIV mode with openssh, it just requires the necessary module and some invocation dance with ssh-agent https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK... or Filippo Valsordas yubikey-agent https://github.com/FiloSottile/yubikey-agent

[knorker]

What invocation dance?

This works:

"ssh -oPKCS11Provider=/path/to/opensc-pkcs11.so [e-mail]"

Or you place that in your ~/.ssh/config

Host *

  PKCS11Provider /path/to/opensc-pkcs11.so

[knorker]

Another guide, that doesn't even require yubico's PKCS11 module: https://ruimarinho.gitbooks.io/yubikey-handbook/content/ssh/...