yubikey

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
yubico-piv-tool -s 9a -a generate -k --pin-policy=once --touch-policy=never --algorithm=ECCP256 -o public.pem
yubico-piv-tool -a verify-pin -a selfsign-certificate -s 9a -S '/CN=wiloon/' --valid-days=3650 -i public.pem -o cert.pem
yubico-piv-tool -k -a import-certificate -s 9a -i cert.pem
ssh-keygen -D /usr/lib/libykcs11.so -e
yubico-piv-tool -a status
ssh-add -s /usr/lib/libykcs11.so
ssh-add -L

Host github.com
 PKCS11Provider /usr/lib/libykcs11.so
 Port 22
 User foobar

yubico-piv-tool -s 9a  -a import-key -k --pin-policy=once --touch-policy=always -i id_rsa.pem
ssh-keygen -D /usr/lib/libykcs11.so -e
ssh-add -s /usr/lib/libykcs11.so
yubico-piv-tool -a status

https://ruimarinho.gitbooks.io/yubikey-handbook/content/ssh/authenticating-ssh-with-piv-and-pkcs11-client/ https://mdrights.github.io/os-observe/posts/2020/12/yubikey-ssh-login.html

Step 7: So far, so good. The problem comes when you unplug the device and reinsert it. SSH just gives an error “agent refused operation”:

ssh babyspice.example.com sign_and_send_pubkey: signing failed for RSA “Public key for PIV Authentication” from agent: agent refused operation jes@babyspice.example.com’s password: It took me a little while to find out what was going on here because it wasn’t mentioned in the YubiCo tutorial. Eventually I found this GitHub issue. The problem is that the SSH agent does not reinitialise libykcs11 when the YubiKey is plugged in (because it has no way to know that it should), which means libykcs11 doesn’t get a chance to ask you for the PIN, which means it can’t unlock the YubiKey, which means it can’t use it for SSH authentication.

This seems like a pretty big oversight, but fortunately it’s quite easy to work around. All you need to do is remove and re-add the keys provided by libykcs11. I added this to my ~/.bashrc based on this comment on the GitHub issue:

alias yf="ssh-add -e /usr/lib/x86_64-linux-gnu/libykcs11.so; ssh-add -s /usr/lib/x86_64-linux-gnu/libykcs11.so”

https://incoherency.co.uk/blog/stories/yubikey.html

https://ruimarinho.gitbooks.io/yubikey-handbook/content/ssh/authenticating-ssh-with-piv-and-pkcs11-client/

其它

硬件密钥

yubikey, Nitrokey，Google Titan， CanoKeys

软件密钥

Solokeys，U2F-zero

TOTP

Google Authenticator
Microsoft Authenticator
Authy
andOTP

WebAuthn

https://webauthn.io/

CanoKey

https://blog.cubercsl.site/post/canokey-unboxing/

CanoKey由清华大学的一些老师/学生（同时也是开源社区的大佬）所写，有软硬件（包括PCB设计）皆开源的stm32版本，也有使用密码学芯片的发售版本（其核心功能一致，只是速度较大差别），可供国内广大用户、企业选用，满足其硬件密钥乃至安全性需求。

这是「合法」的（参考《密码法》），「廉价」的（比市场同类商品价格低，功能更加丰富），「易用」的（相关软件已经发布）。

同时，用户可以体验虚拟硬件密钥，进行构建/购买前的测试与游玩！同时也欢迎用户参与核心代码库的贡献，您的贡献可能出现在下一版的发售中！

fido2

https://www.yubico.com/products/computer-login-tools/ https://zh.101-help.com/236052d633-configure-use-yubikey-secure-loginzai-windows-10-local-account/

https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
# Yubico Authenticator 6.0+
curl -O https://developers.yubico.com/yubioath-flutter/Releases/yubico-authenticator-latest-linux.tar.gz
tar zxvf yubico-authenticator-latest-linux.tar.gz
cd yubico-authenticator-7.1.1-linux
./desktop_integration.sh -i

# install yubikey manager
# visit this page, https://support.yubico.com/hc/en-us/articles/360016649039-Installing-Yubico-Software-on-Linux
# download the app image: https://developers.yubico.com/yubikey-manager-qt/Releases/yubikey-manager-qt-latest-linux.AppImage
# pcscd
sudo apt install pcscd
sudo  systemctl start  pcscd
sudo  systemctl enable  pcscd
systemctl is-enabled pcscd

# yubikey-manager
sudo add-apt-repository ppa:yubico/stable
sudo udevadm --version

# u2f
sudo apt-get install libpam-u2f
mkdir -p ~/.config/Yubico
pamu2fcfg > ~/.config/Yubico/u2f_keys
# touch the metal contact to confirm the association

# add backup device
pamu2fcfg -n >> ~/.config/Yubico/u2f_keys

# login
sudo vim  /etc/pam.d/gdm-password

https://support.yubico.com/hc/en-us/articles/360018695819-Ubuntu-Linux-20-Login-Guide-Challenge-Response

1
2
3
4
5
6
sudo apt install libpam-yubico yubikey-manager
ykman otp chalresp -g 2
# otp: deals with the one time password functionality
# chalresp: for the challenge-response feature
# -g: generate a new challenge-response key
# 2 targeting the second slot of yubikey

1
sudo vim /etc/pam.d/yubico-sufficient

content of /etc/pam.d/yubico-sufficient

1
auth sufficient pam_yubico.so mode=challenge-response debug debug_file=/var/log/pam_yubico.log

1
sudo vim /etc/pam.d/sudo

Add the line above the “@include common-auth” line.

1
@include yubico-sufficient

1
2
# 测试
sudo echo test

1
sudo vim /etc/pam.d/gdm-password

Add the line above the “@include common-auth” line.

1
@include yubico-sufficient

for for TTY

1
sudo vim /etc/pam.d/login

Add the line above the “@include common-auth” line.

1
@include yubico-sufficient

Contents

yubikey

HMAC-SHA1 challenge-response

U2F mode:

piv ssh key

其它

硬件密钥

软件密钥

TOTP

WebAuthn

CanoKey

fido2

yubikey win 10 login

ubuntu yubikey login

ubuntu yubikey login HMAC-SHA1 challenge-response

for login

for for TTY