Using a hardware key for better security - Revision history

Haars0011 at 13:16, 25 March 2026

2026-03-25T13:16:13Z

← Older revision		Revision as of 15:16, 25 March 2026
Line 46:		Line 46:

	An example exchange looks like this:		An example exchange looks like this:
			<syntaxhighlight lang="bash">
	user001@LAPTOP:~$ ssh-keygen -t ed25519-sk -O resident -O no-touch-required -O application=ssh:anunna -C "first.lastname@wur.nl"		user001@LAPTOP:~$ ssh-keygen -t ed25519-sk -O resident -O no-touch-required -O application=ssh:anunna -C "first.lastname@wur.nl"
	Generating public/private ed25519-sk key pair.		Generating public/private ed25519-sk key pair.
Line 56:		Line 57:
	Your identification has been saved in /home/user001/.ssh/id_ed25519_sk		Your identification has been saved in /home/user001/.ssh/id_ed25519_sk
	Your public key has been saved in /home/user001/.ssh/id_ed25519_sk.pub		Your public key has been saved in /home/user001/.ssh/id_ed25519_sk.pub
			</syntaxhighlight>

	==== Copy your key: ====		==== Copy your key: ====
Line 63:		Line 65:

	To allow touchless entry, we'll need to tell the SSH daemon to allow that:		To allow touchless entry, we'll need to tell the SSH daemon to allow that:
			<syntaxhighlight lang="bash">
	# Copy over key		# Copy over key
	ssh login.anunna.wur.nl "umask 0077; mkdir -p ~/.ssh; echo 'no-touch-required $(cat ~/.ssh/id_ed25519_sk.pub)' >> ~/.ssh/authorized_keys"		ssh login.anunna.wur.nl "umask 0077; mkdir -p ~/.ssh; echo 'no-touch-required $(cat ~/.ssh/id_ed25519_sk.pub)' >> ~/.ssh/authorized_keys"
	# Check for key		# Check for key
	ssh login.anunna.wur.nl 'tail -1 .ssh/authorized_keys'		ssh login.anunna.wur.nl 'tail -1 .ssh/authorized_keys'
			</syntaxhighlight>
	==== Key use ====		==== Key use ====
	On the machine that you created the key, a stub file will have been added to point ssh-agent to the hardware key. If the SSH agent was already running at the time of key creation, you may need to run <code>ssh-add ~/.ssh/id_ed25519_sk</code> once to load it manually.		On the machine that you created the key, a stub file will have been added to point ssh-agent to the hardware key. If the SSH agent was already running at the time of key creation, you may need to run <code>ssh-add ~/.ssh/id_ed25519_sk</code> once to load it manually.

Haars0011 at 13:12, 25 March 2026

2026-03-25T13:12:48Z

← Older revision		Revision as of 15:12, 25 March 2026
Line 3:		Line 3:
	With that key, you can implement multifactor authentication for your SSH connections.		With that key, you can implement multifactor authentication for your SSH connections.

	Depending on ~~you~~ choices and setup, you can make it very secure, so that without the key, pin and password your SSH key won't be able to be used.		Depending on your choices and setup, you can make it very secure, so that without the key, pin and password your SSH key won't be able to be used.

	The steps below are adaptations of https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html		The steps below are adaptations of https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html
Line 10:		Line 10:
	There are different levels of security you can apply, each being more secure, but also introducing an extra step before you have an active session.		There are different levels of security you can apply, each being more secure, but also introducing an extra step before you have an active session.

	There a three "interactions" that can be used:		There are three "interactions" that can be used:

	# Enforce/use a password to unlock your SSH key		# Enforce/use a password to unlock your SSH key
Line 82:		Line 82:
	Besides that, you will have to replace the MacOS ssh-agent with the one from openssh.		Besides that, you will have to replace the MacOS ssh-agent with the one from openssh.

	First, download and inspect the LaunchAgent plist before loading it:		First, download and inspect the LaunchAgent plist before loading it:<syntaxhighlight lang="bash">
	curl --output ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist ~~<nowiki>~~https://gist.githubusercontent.com/partikus/cd45013b1274af8ae63b17030d89176c/raw/d34dfae3872dec38137e8a51780fbcb95380034c/com.homebrew.ssh-agent.plist~~</nowiki>~~		# Get the plist
	# Review the file contents before proceeding		curl --output ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist https://gist.githubusercontent.com/partikus/cd45013b1274af8ae63b17030d89176c/raw/d34dfae3872dec38137e8a51780fbcb95380034c/com.homebrew.ssh-agent.plist
	cat ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist		# Review the file contents before proceeding
			cat ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist
			</syntaxhighlight>The content should look like this:<syntaxhighlight lang="xml"><?xml version="1.0" encoding="UTF-8"?>
			<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
			<plist version="1.0">
			<dict>
			<key>Label</key>
			<string>com.homebrew.ssh-agent</string>
			<key>ProgramArguments</key>
			<array>
			<string>/bin/sh</string>
			<string>-c</string>
			<!-- We reuse SSH_AUTH_SOCK from com.openssh.ssh-agent -->
			<string>rm -f $SSH_AUTH_SOCK; exec /opt/homebrew/bin/ssh-agent -D -a $SSH_AUTH_SOCK</string>
			</array>
			<key>RunAtLoad</key>
			<true/>
			</dict>
			</plist></syntaxhighlight>Then load it and disable the Apple agent:<syntaxhighlight lang="bash">
			# enable the homebrew ssh-agent
			launchctl bootstrap gui/$UID ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist

	~~Then load it and disable the Apple agent:~~		# disable the default ssh-agent
	# disable the default ssh-agent		launchctl disable gui/$UID/com.openssh.ssh-agent
	launchctl disable gui/$UID/com.openssh.ssh-agent		launchctl stop gui/$UID/com.openssh.ssh-agent
	launchctl stop gui/$UID/com.openssh.ssh-agent
			# verify installation (you should see com.homebrew.ssh-agent)
	~~# enable the homebrew ssh-agent~~		launchctl list \| grep ssh
	~~launchctl bootstrap gui/$UID ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist~~		</syntaxhighlight>If there are issues with the MacOS ssh-agent, try a reboot, do another verify, and only the homebrew one should be present.

	# verify installation (you should see com.homebrew.ssh-agent)
	launchctl list \| grep ssh
	If there are issues with the MacOS ssh-agent, try a reboot, do another verify, and only the homebrew one should be present.

	After this, open a new terminal. Verify that <code>$SSH_AUTH_SOCK</code> points to the Homebrew agent socket (not the Apple one) before continuing:		After this, open a new terminal. Verify that <code>$SSH_AUTH_SOCK</code> points to the Homebrew agent socket (not the Apple one) before continuing:

Haars0011 at 13:06, 25 March 2026

2026-03-25T13:06:09Z

← Older revision		Revision as of 15:06, 25 March 2026
Line 22:		Line 22:
	# Use pin and touch for each new SSH session (use SSH agent for password)		# Use pin and touch for each new SSH session (use SSH agent for password)
	# Use touch for each new SSH session (use SSH agent for password, but no PIN enforcement in key)		# Use touch for each new SSH session (use SSH agent for password, but no PIN enforcement in key)
	# Use SSH key password ~~and touch~~ for ~~first~~ SSH session (~~pass in~~ SSH agent, no PIN ~~and~~ touch ~~enforcement in key~~)		# Use SSH key password for each new SSH session (use SSH agent to cache passphrase; no PIN or touch required per-session)

	The last one is the least intrusive, and as an attacker would need physical access to your device to circumvent your security, this is probably fine for most people.		The last one is the least intrusive, and as an attacker would need physical access to your device to circumvent your security, this is probably fine for most people.
Line 39:		Line 39:
	The options are:		The options are:

	* <code>-t ed25519-sk</code> : Type of key, this is the more secure option		* <code>-t ed25519-sk</code> : Type of key, this is the more secure option. If your hardware key does not support ed25519-sk, use <code>-t ecdsa-sk</code> as a fallback.
	* <code>-O resident</code> : Store the SSH key on your hardware key, makes it easier to use on another machine		* <code>-O resident</code> : Store the SSH key on your hardware key, makes it easier to use on another machine
	* <code>-O no-touch-required</code> : No need to touch the hardware key every time		* <code>-O no-touch-required</code> : No need to touch the hardware key every time
	* <code>-O application=ssh:anunna~~.wur.nl~~</code> : identifier for the key on your hardware key		* <code>-O application=ssh:anunna</code> : identifier for the key on your hardware key
	* <code>-C "[Your comment to identify this key on the server]"</code> : identifier for the key on the server		* <code>-C "[Your comment to identify this key on the server]"</code> : identifier for the key on the server

	An example exchange looks like this:		An example exchange looks like this:
	user001@LAPTOP:~ % ssh-keygen -t ed25519-sk -O resident -O no-touch-required -O application=ssh:anunna -C "first.lastname@wur.nl"		user001@LAPTOP:~$ ssh-keygen -t ed25519-sk -O resident -O no-touch-required -O application=ssh:anunna -C "first.lastname@wur.nl"
	Generating public/private ed25519-sk key pair.		Generating public/private ed25519-sk key pair.
	You may need to touch your authenticator to authorize key generation.		You may need to touch your authenticator to authorize key generation.
	Enter PIN for authenticator:		Enter PIN for authenticator:
	You may need to touch your authenticator again to authorize key generation.		You may need to touch your authenticator again to authorize key generation.
	Enter file in which to save the key (/~~Users~~/user001/.ssh/id_ed25519_sk):		Enter file in which to save the key (/home/user001/.ssh/id_ed25519_sk):
	Enter passphrase for "/~~Users~~/user001/.ssh/id_ed25519_sk" (empty for no passphrase):		Enter passphrase for "/home/user001/.ssh/id_ed25519_sk" (empty for no passphrase):
	Enter same passphrase again:		Enter same passphrase again:
	Your identification has been saved in /~~Users~~/user001/.ssh/id_ed25519_sk		Your identification has been saved in /home/user001/.ssh/id_ed25519_sk
	Your public key has been saved in /~~Users~~/user001/.ssh/id_ed25519_sk.pub		Your public key has been saved in /home/user001/.ssh/id_ed25519_sk.pub

	==== Copy your key: ====		==== Copy your key: ====
	To be able to log in, the server will have to have the public part of your key.		To be able to log in, the server will have to have the public part of your key.

	For that, copy the contents of your public key, in my case <code>/~~Users~~/user001/.ssh/id_ed25519_sk.pub</code> to <code>$HOME/.ssh/authorized_keys</code>		For that, copy the contents of your public key, in my case <code>/home/user001/.ssh/id_ed25519_sk.pub</code> to <code>$HOME/.ssh/authorized_keys</code>

	To allow touchless entry, we'll need to tell the SSH daemon to allow that:		To allow touchless entry, we'll need to tell the SSH daemon to allow that:
Line 69:		Line 69:

	==== Key use ====		==== Key use ====
	On the machine that you created the key, ~~there will be~~ a stub file added to point ssh-agent to the hardware key, ~~so that machine should work out of the box~~.		On the machine that you created the key, a stub file will have been added to point ssh-agent to the hardware key. If the SSH agent was already running at the time of key creation, you may need to run <code>ssh-add ~/.ssh/id_ed25519_sk</code> once to load it manually.

	On other machines, you can load the private SSH key from the hardware key with		On other machines, you can load the private SSH key from the hardware key with (requires OpenSSH ≥ 8.3):
	ssh-add -K		ssh-add -K
	After this all, you should be able to login without issue.		After this all, you should be able to login without issue.
Line 80:		Line 80:
	So:		So:
	brew install openssh		brew install openssh
	Besides that, you will have to replace the MacOS ssh-agent with the one from openssh:		Besides that, you will have to replace the MacOS ssh-agent with the one from openssh.
	~~# Download~~ the plist
	curl ~~--silent~~ --output ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist <nowiki>https://gist.githubusercontent.com/partikus/cd45013b1274af8ae63b17030d89176c/raw/d34dfae3872dec38137e8a51780fbcb95380034c/com.homebrew.ssh-agent.plist</nowiki>		First, download and inspect the LaunchAgent plist before loading it:
			curl --output ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist <nowiki>https://gist.githubusercontent.com/partikus/cd45013b1274af8ae63b17030d89176c/raw/d34dfae3872dec38137e8a51780fbcb95380034c/com.homebrew.ssh-agent.plist</nowiki>
			# Review the file contents before proceeding
			cat ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist

			Then load it and disable the Apple agent:
	# disable the default ssh-agent		# disable the default ssh-agent
	launchctl disable gui/$UID/com.openssh.ssh-agent		launchctl disable gui/$UID/com.openssh.ssh-agent
Line 95:		Line 99:
	If there are issues with the MacOS ssh-agent, try a reboot, do another verify, and only the homebrew one should be present.		If there are issues with the MacOS ssh-agent, try a reboot, do another verify, and only the homebrew one should be present.

	After this, open a new terminal ~~, and~~ follow the Linux flow.		After this, open a new terminal. Verify that <code>$SSH_AUTH_SOCK</code> points to the Homebrew agent socket (not the Apple one) before continuing:
			echo $SSH_AUTH_SOCK
			Then follow the Linux flow above.

	=== Windows ===		=== Windows ===
	(needs to be filled by a Windows user)		(needs to be filled by a Windows user)

Prins0891 at 08:25, 5 March 2026

2026-03-05T08:25:26Z

Haars0011 at 17:24, 3 March 2026

2026-03-03T17:24:35Z

← Older revision		Revision as of 19:24, 3 March 2026
Line 67:		Line 67:
	# Check for key		# Check for key
	ssh login.anunna.wur.nl 'tail -1 .ssh/authorized_keys'		ssh login.anunna.wur.nl 'tail -1 .ssh/authorized_keys'
	~~Key use~~

			==== Key use ====
	On the machine that you created the key, there will be a stub file added to point ssh-agent to the hardware key, so that machine should work out of the box.		On the machine that you created the key, there will be a stub file added to point ssh-agent to the hardware key, so that machine should work out of the box.

	On other machines, you can load the private SSH key from the hardware key with		On other machines, you can load the private SSH key from the hardware key with
	ssh-add -K		ssh-add -K
			After this all, you should be able to login without issue.

	=== MacOS ===		=== MacOS ===

Haars0011 at 17:21, 3 March 2026

2026-03-03T17:21:12Z

← Older revision		Revision as of 19:21, 3 March 2026
Line 67:		Line 67:
	# Check for key		# Check for key
	ssh login.anunna.wur.nl 'tail -1 .ssh/authorized_keys'		ssh login.anunna.wur.nl 'tail -1 .ssh/authorized_keys'
			Key use

			On the machine that you created the key, there will be a stub file added to point ssh-agent to the hardware key, so that machine should work out of the box.

			On other machines, you can load the private SSH key from the hardware key with
			ssh-add -K

	=== MacOS ===		=== MacOS ===

Haars0011 at 13:10, 3 March 2026

2026-03-03T13:10:36Z

← Older revision		Revision as of 15:10, 3 March 2026
Line 73:		Line 73:
	So:		So:
	brew install openssh		brew install openssh
	Besides that, you will have to ~~add this snippet to your .zshrc file, otherwise~~ the ~~default~~ ssh-agent ~~will be used~~:		Besides that, you will have to replace the MacOS ssh-agent with the one from openssh:
	# ~~Use Homebrew's ssh-agent instead of Apple's~~		# Download the plist
	~~if [~~ -~~z "$SSH_AGENT_PID" ] \|\| ! ps~~ -~~p "$SSH_AGENT_PID"~~ > /~~dev~~/~~null 2~~>~~&1; then~~		curl --silent --output ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist <nowiki>https://gist.githubusercontent.com/partikus/cd45013b1274af8ae63b17030d89176c/raw/d34dfae3872dec38137e8a51780fbcb95380034c/com.homebrew.ssh-agent.plist</nowiki>
	# ~~Kill Apple's~~ agent
	~~pkill -u~~ $~~USER~~ /~~usr~~/~~bin~~/ssh-agent ~~2>/dev/null~~		# disable the default ssh-agent
	# ~~Start Homebrew's~~		launchctl disable gui/$UID/com.openssh.ssh-agent
	~~eval "~~$~~($(brew --prefix openssh)~~/~~bin~~/ssh-agent -s)"		launchctl stop gui/$UID/com.openssh.ssh-agent
	fi
			# enable the homebrew ssh-agent
			launchctl bootstrap gui/$UID ~/Library/LaunchAgents/com.homebrew.ssh-agent.plist

			# verify installation (you should see com.homebrew.ssh-agent)
			launchctl list \| grep ssh
			If there are issues with the MacOS ssh-agent, try a reboot, do another verify, and only the homebrew one should be present.

	After this, open a new terminal , and follow the Linux flow.		After this, open a new terminal , and follow the Linux flow.

	=== Windows ===		=== Windows ===
	(needs to be filled by a Windows user)		(needs to be filled by a Windows user)

Haars0011 at 11:39, 3 March 2026

2026-03-03T11:39:55Z

← Older revision		Revision as of 13:39, 3 March 2026
Line 81:		Line 81:
	eval "$($(brew --prefix openssh)/bin/ssh-agent -s)"		eval "$($(brew --prefix openssh)/bin/ssh-agent -s)"
	fi		fi
			After this, open a new terminal , and follow the Linux flow.

	=== Windows ===		=== Windows ===
	(needs to be filled by a Windows user)		(needs to be filled by a Windows user)

Haars0011 at 11:38, 3 March 2026

2026-03-03T11:38:45Z

← Older revision		Revision as of 13:38, 3 March 2026
Line 64:		Line 64:
	To allow touchless entry, we'll need to tell the SSH daemon to allow that:		To allow touchless entry, we'll need to tell the SSH daemon to allow that:
	# Copy over key		# Copy over key
	ssh ~~-o ClearAllForwardings=yes~~ login.anunna.wur.nl "umask 0077; mkdir -p ~/.ssh; echo 'no-touch-required $(cat ~/.ssh/id_ed25519_sk.pub)' >> ~/.ssh/authorized_keys"		ssh login.anunna.wur.nl "umask 0077; mkdir -p ~/.ssh; echo 'no-touch-required $(cat ~/.ssh/id_ed25519_sk.pub)' >> ~/.ssh/authorized_keys"
	# Check for key		# Check for key
	ssh login.anunna.wur.nl 'tail -1 .ssh/authorized_keys'		ssh login.anunna.wur.nl 'tail -1 .ssh/authorized_keys'

Haars0011 at 11:38, 3 March 2026

2026-03-03T11:38:13Z

← Older revision		Revision as of 13:38, 3 March 2026
Line 44:		Line 44:
	* <code>-O application=ssh:anunna.wur.nl</code> : identifier for the key on your hardware key		* <code>-O application=ssh:anunna.wur.nl</code> : identifier for the key on your hardware key
	* <code>-C "[Your comment to identify this key on the server]"</code> : identifier for the key on the server		* <code>-C "[Your comment to identify this key on the server]"</code> : identifier for the key on the server


	An example exchange looks like this:		An example exchange looks like this:
Line 58:		Line 57:
	Your public key has been saved in /Users/haars001/.ssh/id_ed25519_sk.pub		Your public key has been saved in /Users/haars001/.ssh/id_ed25519_sk.pub

			==== Copy your key: ====

	Copy your key:

	To be able to log in, the server will have to have the public part of your key.		To be able to log in, the server will have to have the public part of your key.

← Older revision		Revision as of 10:25, 5 March 2026
Line 1:		Line 1:
	~~Employees~~ can get a Yubikey hardware key for free at the servicedesk in Forum.		WUR employees can get a Yubikey hardware key for free at the servicedesk in Forum.

	With that key, you can implement multifactor authentication for your SSH connections.		With that key, you can implement multifactor authentication for your SSH connections.
Line 36:		Line 36:
	==== Create your key: ====		==== Create your key: ====
	(do this on your laptop or desktop)		(do this on your laptop or desktop)
	ssh-keygen -t ed25519-sk -O resident -O no-touch-required -O application=ssh:anunna~~.wur.nl~~ -C "[Your comment to identify this key on the server]"		ssh-keygen -t ed25519-sk -O resident -O no-touch-required -O application=ssh:anunna -C "[Your comment to identify this key on the server]"
	The options are:		The options are:

Line 46:		Line 46:

	An example exchange looks like this:		An example exchange looks like this:
	~~haars001~~@~~L0160372~~:~ % ssh-keygen -t ed25519-sk -O resident -O no-touch-required -O application=ssh:anunna~~.wur.nl~~ -C "~~jan~~.~~vanhaarst~~@wur.nl"		user001@LAPTOP:~ % ssh-keygen -t ed25519-sk -O resident -O no-touch-required -O application=ssh:anunna -C "first.lastname@wur.nl"
	Generating public/private ed25519-sk key pair.		Generating public/private ed25519-sk key pair.
	You may need to touch your authenticator to authorize key generation.		You may need to touch your authenticator to authorize key generation.
	Enter PIN for authenticator:		Enter PIN for authenticator:
	You may need to touch your authenticator again to authorize key generation.		You may need to touch your authenticator again to authorize key generation.
	Enter file in which to save the key (/Users/~~haars001~~/.ssh/id_ed25519_sk):		Enter file in which to save the key (/Users/user001/.ssh/id_ed25519_sk):
	Enter passphrase for "/Users/~~haars001~~/.ssh/id_ed25519_sk" (empty for no passphrase):		Enter passphrase for "/Users/user001/.ssh/id_ed25519_sk" (empty for no passphrase):
	Enter same passphrase again:		Enter same passphrase again:
	Your identification has been saved in /Users/~~haars001~~/.ssh/id_ed25519_sk		Your identification has been saved in /Users/user001/.ssh/id_ed25519_sk
	Your public key has been saved in /Users/~~haars001~~/.ssh/id_ed25519_sk.pub		Your public key has been saved in /Users/user001/.ssh/id_ed25519_sk.pub

	==== Copy your key: ====		==== Copy your key: ====
	To be able to log in, the server will have to have the public part of your key.		To be able to log in, the server will have to have the public part of your key.

	For that, copy the contents of your public key, in my case <code>/Users/~~haars001~~/.ssh/id_ed25519_sk.pub</code> to <code>$HOME/.ssh/authorized_keys</code>		For that, copy the contents of your public key, in my case <code>/Users/user001/.ssh/id_ed25519_sk.pub</code> to <code>$HOME/.ssh/authorized_keys</code>

	To allow touchless entry, we'll need to tell the SSH daemon to allow that:		To allow touchless entry, we'll need to tell the SSH daemon to allow that: