SSH and FIDO

SSH and FIDO

用 fido key 搭配 ssh-keygen 產生用來配合認証的實體金鑰

先上網買 fido2 的 usb 接上電腦

[44270.657019] usb 1-4: new full-speed USB device number 7 using xhci_hcd
[44270.806521] usb 1-4: New USB device found, idVendor=32a3, idProduct=3201, bcdDevice= 1.10
[44270.806526] usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=5
[44270.806528] usb 1-4: Product: Idem Key
[44270.806530] usb 1-4: Manufacturer: GoTrust
[44270.806531] usb 1-4: SerialNumber: 200801000734
[44270.810666] hid-generic 0003:32A3:3201.000E: hiddev0,hidraw1: USB HID v1.00 Device [GoTrust Idem Key] on usb-0000:00:14.0-4/input1
[44270.811503] input: GoTrust Idem Key as /devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4:1.2/0003:32A3:3201.000F/input/input69
[44270.873337] hid-generic 0003:32A3:3201.000F: input,hidraw2: USB HID v1.01 Keyboard [GoTrust Idem Key] on usb-0000:00:14.0-4/input2

產生 ssh key

ssh-keygen -t ecdsa-sk

Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator 
to authorize key generation.

Enter file in which to save the key 
(/home/ubuntu/.ssh/id_ecdsa_sk):

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in 
/home/ubuntu/.ssh/id_ecdsa_sk

Your public key has been saved in 
/home/ubuntu/.ssh/id_ecdsa_sk.pub

看看 .ssh 應該就有 id_ecdsa_sk...

複製公鑰到遠端

ssh-copy-id -i ~/.ssh/id_ecdsa_sk.pub user@host

之後連線就可以使用

ssh -i id_ecdsa_sk user@host

更新到 .ssh/config 例如:

Host example
  User user
  HostName example.demo.com
  IdentityFile ~/.ssh/id_ecdsa_sk

之後登入的時候 ssh example 即可!

建議也加上 MasterControl 在時間內可以用既有的session; 要不然一直要手點usb 稍微有點煩,可以這樣設定:

Host *
    ControlMaster auto
    ControlPath /tmp/ssh-%r@%h:%p
    ControlPersist 600

重點要注意 ssh 版本需要在 8.2以上,可以用ssh -v 看看!

https://ubuntu.com/blog/enhanced-ssh-and-fido-authentication-in-ubuntu-20-04-lts
https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html
https://docs.rc.fas.harvard.edu/kb/using-ssh-controlmaster-for-single-sign-on/