How to Use FIDO Keys with SSH Agent for Improved Security

Introduction

In today's digital world, securing access to servers and remote systems is more important than ever. One of the most popular tools for secure remote access is OpenSSH. With the increasing concern for security, OpenSSH now supports FIDO security keys, including YubiKeys, for adding an extra layer of security to your SSH credentials. In this article, we will explore how to use two YubiKeys to store SSH credentials and log in to a remote host using OpenSSH.

Prerequisites

Before we begin, ensure you have the following:

Two YubiKeys
OpenSSH installed on your local machine and remote host
A basic understanding of SSH and FIDO security keys

Generating SSH Keys with a YubiKey

To generate an SSH key with a YubiKey, follow these steps:

Plug in your YubiKey to your local machine.
Run the following command to generate a new SSH key:

 ssh-keygen -o -a100 -t rsa-sha2-256 --no-infocert --out mykey.rsa --quiet --force-key-type=rsa-scp --insert

This command generates a new RSA key using the OpenSSH algorithm rsa-scp, which is optimized for use with smart cards like the YubiKey. The --no-infocert and --quiet flags prevent the creation of an info file and suppress informational messages, respectively. The --force-key-type flag forces the creation of an RSA-SCP key. The --insert flag tells ssh-keygen to insert the new key instead of overwriting any existing keys.

When prompted, press the YubiKey button to provide the necessary authentication data. The key generation process will complete, and you will be asked to enter a passphrase for the new key. However, since we will be using the YubiKey for authentication, we can skip this step by pressing Enter.

Adding the SSH Key to the ssh-agent

Next, we need to add the new SSH key to the ssh-agent:

Start the ssh-agent in the background:

 eval "$(ssh-agent -s)"

Add the newly generated SSH key to the ssh-agent:

 ssh-add mykey.rsa

Unlock the YubiKey:

 ykman --device /dev/ttyUSB0 --slot 0 unlock

Add the YubiKey to the ssh-agent:

 ssh-add --insert

Press the YubiKey button to authenticate and add it to the ssh-agent.

Configuring OpenSSH to Use the YubiKey

Now that we have added the SSH key to the ssh-agent and the YubiKey, we need to configure OpenSSH to use the YubiKey for authentication:

Edit the SSH config file:

 nano ~/.ssh/config

Add the following lines to the config file:

 Host my_remote_host
 HostName remote_host_ip_address
 IdentityFile ~/.ssh/mykey.rsa
 PubkeyAuthentication yes
 PassphraseAuthentication no
 AuthenticationMethods publickey,keyboard-interactive
 KeyboardInteractiveDevices /dev/ttyUSB0:0

Replace "my_remote_host" with the desired hostname or IP address, and "remote_host_ip_address" with the remote host's IP address.

Logging In to the Remote Host

Now that everything is set up, you can log in to the remote host using your YubiKeys:

Unlock the YubiKeys:

 ykman --device /dev/ttyUSB0 --slot 0 unlock

 ssh my_remote_host

When prompted for a password, press the YubiKey button to authenticate using the private key stored in the ssh-agent.

In this article, we explored how to use two YubiKeys to store SSH credentials and log in to a remote host using OpenSSH. We generated a new SSH key using a YubiKey, added it to the ssh-agent, and configured OpenSSH to use the YubiKey for authentication. By following these steps, you can significantly improve the security of your SSH credentials.