diff --git a/Yubikey.md b/Yubikey.md index e40fbd1..869ab26 100644 --- a/Yubikey.md +++ b/Yubikey.md @@ -4,6 +4,7 @@ A list of sites that my yubikey's are registerd with. | Site | Primary Key Registered | Backup Key Registered | | -------------------- | :--------------------: | :-------------------: | +| Cloudflare | ✅ | | | Facebook | ✅ | | | first-financial-bank | ✅ | | | github | ✅ | | @@ -211,25 +212,45 @@ Remove the yubikey and try again, it shouldn't be possible without the yubikey b > being the important part > [stack-overflow-link](https://stackoverflow.com/questions/78554135/unverified-github-commits-using-gpg-keys-on-yubikey). -## Setting up macOS to use gpg-agent for ssh +## FIDO SSH setup -The following lines need added to `~/.gnupg/gpg-agent.conf`, `enable-ssh-support`. +[Setup Instructions](https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html) + +> Note: I tried using the GPG ssh-agent, but it was tough to get configured properly and this FIDO +> method is more similar to how I'm used to working with SSH. + +You must setup a FIDO PIN prior to starting, which can be done in the `Passkeys` section of the +Yubico-Authenticator app. + +I had to start by installing OpenSSH and reload my shell. ```bash -echo enable-ssh-support > ~/.gnupg/gpg-agent.conf +brew install openssh && zsh -l ``` -The following lines were added to `.zshrc` to enable the usage of the gpg-agent for ssh (should need -to be done again, as long as dotfiles are installed and linked correctly). +Generate the SSH credentials, make sure to secure the private key that is generated with a +passphrase. When using SSH you will need to provide the password to unlock the private SSH key and +also a short press on the yubikey. ```bash -gpgconf --launch gpg-agent -export SSH_AUTH_SOCK=~/.gnupg/S.gpg-agent.ssh +ssh-keygen -t ed25519-sk -O resident -C "Yubikey (primary)" ``` +#### Adding SSH key to another computer, using the yubikey. + +Move into SSH directory and generate key (yubikey needs to be plugged into the computer). + +```bash +cd ~/.ssh && ssh-keygen -K +``` + +> Note: This makes syncing passwords using `gopass` a PITA the way I currently have it setup with +> different password stores, I may have to consolidate them into a single store to make the friction +> less. + ## Setting Up at First Financial Bank {#first-financial-bank} -When setting up I could only use my phone it wouldn't allow me on my computer. Once you tab the +When setting up I could only use my phone it wouldn't allow me on my computer. Once you tap the device to the phone it prompts for a PIN, this is referring to the FIDO PIN that needs setup prior. This took me a while to figure out and had to factory reset the FIDO application on the yubikey after too many failed attempts where I used the primary PIN to try and unlock the yubikey.