<!doctype html><htmllang=endir=auto><head><metacharset=utf-8><metahttp-equiv=x-ua-compatiblecontent="IE=edge"><metaname=viewportcontent="width=device-width,initial-scale=1,shrink-to-fit=no"><metaname=robotscontent="index, follow"><title>Securing OpenSSH with FIDO2 | PrivSec.dev</title><metaname=keywordscontent="operating systems,linux,security"><metaname=descriptioncontent="PasswordlessauthenticationwithOpenSSHkeyshasbeenthedefactosecuritystandardforyears.SSHkeysaremorerobustsincethey’recryptographicallysanebydefault,andarethereforeresilienttomostbruteforceatacks.They’realsoeasiertomanagewhileenablingaformofdecentralizedauthentication(it’seasyandpainlesstorevokethem).So,what’sthenextstep?Andmoreexactly,whywouldoneneedsomethingevenbetter?
Why? The main problem with SSH keys is that they’re not magic: they consist of a key pair, of which the private key is stored on your disk."><metaname=authorcontent="Wonderfall"><linkrel=canonicalhref=https://wonderfall.dev/openssh-fido2/><linkcrossorigin=anonymoushref=/assets/css/stylesheet.8b523f1730c922e314350296d83fd666efa16519ca136320a93df674d00b6325.cssintegrity="sha256-i1I/FzDJIuMUNQKW2D/WZu+hZRnKE2MgqT32dNALYyU="rel="preload stylesheet"as=style><scriptdefercrossorigin=anonymoussrc=/assets/js/highlight.f413e19d0714851f6474e7ee9632408e58ac146fbdbe62747134bea2fa3415e0.jsintegrity="sha256-9BPhnQcUhR9kdOfuljJAjlisFG+9vmJ0cTS+ovo0FeA="onload=hljs.initHighlightingOnLoad()></script>
<linkrel=iconhref=https://privsec.dev/%3Clink%20/%20abs%20url%3E><linkrel=icontype=image/pngsizes=16x16href=https://privsec.dev/%3Clink%20/%20abs%20url%3E><linkrel=icontype=image/pngsizes=32x32href=https://privsec.dev/%3Clink%20/%20abs%20url%3E><linkrel=apple-touch-iconhref=https://privsec.dev/%3Clink%20/%20abs%20url%3E><linkrel=mask-iconhref=https://privsec.dev/%3Clink%20/%20abs%20url%3E><metaname=theme-colorcontent="#2e2e33"><metaname=msapplication-TileColorcontent="#2e2e33"><noscript><style>#theme-toggle,.top-link{display:none}</style></noscript><metaproperty="og:title"content="Securing OpenSSH with FIDO2"><metaproperty="og:description"content="PasswordlessauthenticationwithOpenSSHkeyshasbeenthedefactosecuritystandardforyears.SSHkeysaremorerobustsincethey’recryptographicallysanebydefault,andarethereforeresilienttomostbruteforceatacks.They’realsoeasiertomanagewhileenablingaformofdecentralizedauthentication(it’seasyandpainlesstorevokethem).So,what’sthenextstep?Andmoreexactly,whywouldoneneedsomethingevenbetter?
Why? The main problem with SSH keys is that they’re not magic: they consist of a key pair, of which the private key is stored on your disk."><metaproperty="og:type"content="article"><metaproperty="og:url"content="https://privsec.dev/os/securing-openssh-with-fido2/"><metaproperty="article:section"content="os"><metaname=twitter:cardcontent="summary"><metaname=twitter:titlecontent="Securing OpenSSH with FIDO2"><metaname=twitter:descriptioncontent="PasswordlessauthenticationwithOpenSSHkeyshasbeenthedefactosecuritystandardforyears.SSHkeysaremorerobustsincethey’recryptographicallysanebydefault,andarethereforeresilienttomostbruteforceatacks.They’realsoeasiertomanagewhileenablingaformofdecentralizedauthentication(it’seasyandpainlesstorevokethem).So,what’sthenextstep?Andmoreexactly,whywouldoneneedsomethingevenbetter?
Why? The main problem with SSH keys is that they’re not magic: they consist of a key pair, of which the private key is stored on your disk."><scripttype=application/ld+json>{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":2,"name":"Operating Systems","item":"https://privsec.dev/os/"},{"@type":"ListItem","position":3,"name":"Securing OpenSSH with FIDO2","item":"https://privsec.dev/os/securing-openssh-with-fido2/"}]}</script><scripttype=application/ld+json>{"@context":"https://schema.org","@type":"BlogPosting","headline":"SecuringOpenSSHwithFIDO2","name":"SecuringOpenSSHwithFIDO2","description":"PasswordlessauthenticationwithOpenSSHkeyshasbeenthedefactosecuritystandardforyears.SSHkeysaremorerobustsincethey\u0026rsquo;recryptographicallysanebydefault,andarethereforeresilienttomostbruteforceatacks.They\u0026rsquo;realsoeasiertomanagewhileenablingaformofdecentralizedauthentication(it\u0026rsquo;seasyandpainlesstorevokethem).So,what\u0026rsquo;sthenextstep?Andmoreexactly,whywouldoneneedsomethingevenbetter?\nWhy?ThemainproblemwithSSHkeysisthatthey\u0026rsquo;renotmagic:theyconsistofakeypair,ofwhichtheprivatekeyisstoredonyourdisk.","keywords":["operatingsystems","linux","security"],"articleBody":"PasswordlessauthenticationwithOpenSSHkeyshasbeenthedefactosecuritystandardforyears.SSHkeysaremorerobustsincethey’recryptographicallysanebydefault,andarethereforeresilienttomostbruteforceatacks.They’realsoeasiertomanagewhileenablingaformofdecentralizedauthentication(it’seasyandpainlesstorevokethem).So,what’sthenextstep?Andmoreexactly,whywouldoneneedsomethingevenbetter?\nWhy?ThemainproblemwithSSHkeysisthatthey’renotmagic:theyconsistofakeypair,ofwhichtheprivatekeyisstoredonyourdisk.Youshouldbewaryofvariousexfiltrationattempts,dependingonyourtheatmodel:\nIfyourdiskisnotencrypted,anyphysicalaccesscouldcompromiseyourkeys.Ifyourprivatekeyisn’tencrypted,maliciousapplicationscouldcompromiseit.Evenwithbothencrypted,maliciousapplicationscouldregisteryourkeystrokes.Alltheseattemptsareparticularlyathingondesktopplatforms,becausetheydon’thaveapropersandboxingmodel.OnWindows,non-UWPappscouldlikelyhavefullaccesstoyour.sshdirectory.OndesktopLinuxdistributions,sandboxingisalsolacking,andthesituationisevenworseifyou’reusingX.orgsinceitallowsappstospyoneachother(andonyourkeyboard)bydesign.AfirstgoodstepwouldbetoonlyuseSSHfromatrusted\u0026decentlysecuresystem.\nAnotherlayerofdefensewouldobviouslybemulti-factorauthentification,orthefactthatyou’rerelyingonasharedsecretinstead.WecanuseFIDO2securitykeysforthat.Thatway,evenifyourprivatekeyiscompromised,theattackerneedsphysicalaccesstoyoursecuritykey.TOTPisanothercommon2FAtechnique,butit’svulnerabletovariousattacks,andreliesonthequalityoftheimplementationontheserver.\nHow?Fortunatelyforus,OpenSSH8.2(releasedinFebruary2020)introducednativesupportforFIDO2/U2F.MostOpenSSHdistributionsshouldhavethemiddlewaresettousethelibfido2library,includingportableversionssuchastheoneforWin32.\nBasically,ssh-keygen-t${key_type}-skwillgenerateforusatoken-backedkeypair.Thekeytypesthataresupporteddependonyoursecuritykey.NewermodelsshouldsupportbothECDSA-P256(ecdsa-sk)andEd25519(ed25519-sk).Ifthelatterisavailable,youshouldpreferit.\nClientconfigurationTogetstarted:\nssh-keygen-ted25519-skThiswillgenerateaid_ed25519_skprivatekeyandaid_ed25519_sk.pubpublickeyin.ssh.Thesearedefaults,butyoucanchangethemifyouwant.Wewillcallthiskeypaira“handle”,becausethey’renotsufficientbythemselvestoderivetherealsecret(asyouguessedit,theFIDO2tokenis
| <span>Originally published at <ahref=https://wonderfall.dev/openssh-fido2/title=https://wonderfall.dev/openssh-fido2/target=_blankrel="noopener noreferrer">wonderfall.dev</a></span></div></header><divclass=toc><details><summaryaccesskey=ctitle="(Alt + C)"><spanclass=details>Table of Contents</span></summary><divclass=inner><ul><li><ahref=#whyaria-label=Why?>Why?</a></li><li><ahref=#howaria-label=How?>How?</a><ul><li><ahref=#client-configurationaria-label="Client configuration">Client configuration</a></li><li><ahref=#server-configurationaria-label="Server configuration">Server configuration</a></li></ul></li><li><ahref=#thats-cool-rightaria-label="That&rsquo;s cool, right?">That’s cool, right?</a></li></ul></div></details></div><divclass=post-content><p>Passwordless authentication with OpenSSH keys has been the <em>de facto</em> security standard for years. SSH keys are more robust since they’re cryptographically sane by default, and are therefore resilient to most bruteforce atacks. They’re also easier to manage while enabling a form of decentralized authentication (it’s easy and painless to revoke them). So, what’s the next step? And more exactly, why would one need something even better?</p><h2id=why>Why?<ahiddenclass=anchoraria-hidden=truehref=#why>#</a></h2><p>The main problem with SSH keys is that they’re not magic: they consist of a key pair, of which the private key is stored on your disk. You should be wary of various exfiltration attempts, depending on your theat model:</p><ul><li>If your disk is not encrypted, any physical access could compromise your keys.</li><li>If your private key isn’t encrypted, malicious applications could compromise it.</li><li>Even with both encrypted, malicious applications could register your keystrokes.</li></ul><p>All these attempts are particularly a thing on desktop platforms, because they don’t have a proper sandboxing model. On Windows, non-UWP apps could likely have full access to your <code>.ssh</code> directory. On desktop Linux distributions, sandboxing is also lacking, and the situation is even worse if you’re using X.org since it allows apps to spy on each other (and on your keyboard) by design. A first good step would be to only use SSH from a trusted & decently secure system.</p><p>Another layer of defense would obviously be multi-factor authentification, or the fact that you’re relying on a shared secret instead. We can use FIDO2 security keys for that. That way, even if your private key is compromised, the attacker needs physical access to your security key. TOTP is another common 2FA technique, but it’s vulnerable to various attacks, and relies on the quality of the implementation on the server.</p><h2id=how>How?<ahiddenclass=anchoraria-hidden=truehref=#how>#</a></h2><p>Fortunately for us, <ahref=https://www.openssh.com/txt/release-8.2>OpenSSH 8.2</a> (released in February 2020) introduced native support for FIDO2/U2F. Most OpenSSH distributions should have the middleware set to use the <code>libfido2</code> library, including portable versions such as the one <ahref=https://github.com/PowerShell/Win32-OpenSSH>for Win32</a>.</p><p>Basically, <code>ssh-keygen -t ${key_type}-sk</code> will generate for us a token-backed key pair. The key types that are supported depend on your security key. Newer models should support both ECDSA-P256 (<code>ecdsa-sk</code>) and Ed25519 (<code>ed25519-sk</code>). If the latter is available, you should prefer it.</p><h3id=client-configuration>Client configuration<ahiddenclass=anchoraria-hidden=truehref=#client-configuration>#</a></h3><p>To get started:</p><pretabindex=0><code>ssh-keygen -t ed25519-sk
</code></pre><p>This will generate a <code>id_ed25519_sk</code> private key and a <code>id_ed25519_sk.pub</code> public key in <code>.ssh</code>. These are defaults, but you can change them if you want. We will call this key pair a “handle”, because they’re not sufficient by themselves to derive the real secret (as you guessed it, the FIDO2 token is needed). <code>ssh-keygen</code> should ask you to touch the key, and enter the PIN prior to that if you did set one (you probably should).</p><p>You can also generate a <strong>resident key</strong> (referred to as <em>discoverable credential</em> in the WebAuthn specification):</p><pretabindex=0><code>ssh-keygen -t ed25519-sk -O resident -O application=ssh:user1
</code></pre><p>As you can see, a few options must be specified:</p><ul><li><code>-O resident</code> will tell <code>ssh-keygen</code> to generate a resident key, meaning that the private “handle” key will also be stored on the security key itself. This has security implications, but you may want that to move seamlessly between different computers. In that case, you should absolutely protect your key with a PIN beforehand.</li><li><code>-O application=ssh:</code> is necessary to instruct that the resident key will use a particular slot, because the security key will have to index the resident keys (by default, they use <code>ssh:</code> with an empty user ID). If this is not specificed, the next key generation might overwrite the previous one.</li><li><code>-O verify-required</code> is optional but instructs that a PIN is required to generate/access the key.</li></ul><p>Resident keys can be retrieved using <code>ssh-keygen -K</code> or <code>ssh-add -K</code> if you don’t want to write them to the disk.</p><h3id=server-configuration>Server configuration<ahiddenclass=anchoraria-hidden=truehref=#server-configuration>#</a></h3><p>Next, transfer your public key over to the server (granted you have already access to it with a regular key pair):</p><pretabindex=0><code>ssh-copy-id -i ~/.ssh/id_ed25519_sk.pub user@server.domain.tld
</code></pre><p><em>Ta-da!</em> But one last thing: we need to make sure the server supports this public key format in <code>sshd_config</code>:</p><pretabindex=0><code>PubkeyAcceptedKeyTypes ssh-ed25519,sk-ssh-ed25519@openssh.com
