SSH and FIDO
用 fido key 搭配 ssh-keygen 產生用來配合認証的實體金鑰
先上網買 fido2 的 usb 接上電腦
[44270.657019] usb 1-4: new full-speed USB device number 7 using xhci_hcd
[44270.806521] usb 1-4: New USB device found, idVendor=32a3, idProduct=3201, bcdDevice= 1.10
[44270.806526] usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=5
[44270.806528] usb 1-4: Product: Idem Key
[44270.806530] usb 1-4: Manufacturer: GoTrust
[44270.806531] usb 1-4: SerialNumber: 200801000734
[44270.810666] hid-generic 0003:32A3:3201.000E: hiddev0,hidraw1: USB HID v1.00 Device [GoTrust Idem Key] on usb-0000:00:14.0-4/input1
[44270.811503] input: GoTrust Idem Key as /devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4:1.2/0003:32A3:3201.000F/input/input69
[44270.873337] hid-generic 0003:32A3:3201.000F: input,hidraw2: USB HID v1.01 Keyboard [GoTrust Idem Key] on usb-0000:00:14.0-4/input2
產生 ssh key
ssh-keygen -t ecdsa-sk
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator
to authorize key generation.
Enter file in which to save the key
(/home/ubuntu/.ssh/id_ecdsa_sk):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in
/home/ubuntu/.ssh/id_ecdsa_sk
Your public key has been saved in
/home/ubuntu/.ssh/id_ecdsa_sk.pub
看看 .ssh 應該就有 id_ecdsa_sk...
複製公鑰到遠端
ssh-copy-id -i ~/.ssh/id_ecdsa_sk.pub user@host
之後連線就可以使用
ssh -i id_ecdsa_sk user@host
更新到 .ssh/config 例如:
Host example
User user
HostName example.demo.com
IdentityFile ~/.ssh/id_ecdsa_sk
之後登入的時候 ssh example 即可!
建議也加上 MasterControl 在時間內可以用既有的session; 要不然一直要手點usb 稍微有點煩,可以這樣設定:
Host *
ControlMaster auto
ControlPath /tmp/ssh-%r@%h:%p
ControlPersist 600
重點要注意 ssh 版本需要在 8.2以上,可以用ssh -v
看看!
https://ubuntu.com/blog/enhanced-ssh-and-fido-authentication-in-ubuntu-20-04-lts
https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html
https://docs.rc.fas.harvard.edu/kb/using-ssh-controlmaster-for-single-sign-on/