Hardware Security Keys

A hardware security key, such as a YubiKey, keeps the SSH private key on the device. Logging in needs the key plugged in and a touch. A copied file alone cannot log in to your servers.

SSH calls these -sk keys. Our panel accepts them in your workspace like any other key.

Requirements

OpenSSH 8.2 or newer on your computer and on the server. Check with ssh -V.
For ed25519-sk: YubiKey firmware 5.2.3 or newer. Older keys use ecdsa-sk instead.
A FIDO2 PIN on the key, for resident keys and PIN checks. On a YubiKey, set it in YubiKey Manager under “Applications”, “FIDO2”, “Set PIN”.

Ubuntu 20.04, Debian 11 and newer ship a recent enough OpenSSH server.

Preparing your computer

Most distributions ship a FIDO capable OpenSSH. Update it and check the version:

sudo apt update && sudo apt install openssh-client   # Debian and Ubuntu
sudo dnf install openssh-clients                     # Fedora, Rocky Linux, AlmaLinux
ssh -V

The OpenSSH that comes with macOS does not support security keys on any version. Install OpenSSH with Homebrew:

brew install openssh
which ssh-keygen

which must print a Homebrew path (/opt/homebrew/bin on Apple Silicon, /usr/local/bin on Intel). If it prints /usr/bin/ssh-keygen, put the Homebrew folder first in your PATH and open a new terminal.

The OpenSSH built into Windows supports security keys from version 8.9. Check it in PowerShell:

ssh -V

If it is older, update Windows, or install the latest Win32-OpenSSH release and put it before the built-in one in your PATH.

If you have Git for Windows, ssh -V can report Git’s OpenSSH instead of the built-in one.

Creating the key

Plug in your key and run:

ssh-keygen -t ed25519-sk -O resident -O verify-required -C "yubikey"

Touch the key when it blinks and enter its PIN. On older keys, use -t ecdsa-sk instead.

-O resident stores the key on the device. You can load it on another computer later.
-O verify-required asks for the PIN and a touch on every login. It needs OpenSSH 8.4 or newer.

To keep several resident keys on one device, give each a name starting with ssh:, for example -O application=ssh:galaxygate.

This creates id_ed25519_sk and id_ed25519_sk.pub. The private file is a handle that does nothing without the device.

Adding the key

Add the contents of id_ed25519_sk.pub to your workspace in the panel. Read more in SSH Keys. For an existing server, add it by hand as shown in Using SSH Keys, or run “Sync SSH Keys” in the panel.

Logging in

ssh -i ~/.ssh/id_ed25519_sk root@203.0.113.10

SSH asks for the PIN (with verify-required), then you touch the key.

Using the key on another computer

Resident keys can be downloaded from the device. On the new computer, prepare OpenSSH as above, then run this in your .ssh folder:

ssh-keygen -K

It writes the handle and public key files to the current folder. On Windows, run it from an administrator prompt.