4

I would like to use my Yubikey's OpenPGP interface to authenticate myself against my OpenSSH server on my Windows 10 computer as showcased here.

I had created the keys according to the documentation.

gpg --card-status would return the following:

Reader ...........: Yubico Yubikey 4 OTP U2F CCID 0
Application ID ...: BEEFBEEFBEEFBEEFBEEFBEEF99990000
Version ..........: 2.1
Manufacturer .....: Yubico
Serial number ....: 99999999
Name of cardholder: John Doe
Language prefs ...: en
Sex ..............: male
URL of public key : https://example.com/pgp.asc
Login data .......: johndoe
Signature PIN ....: required
Key attributes ...: rsa4096 rsa4096 rsa4096
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 39
Signature key ....: BEEF BEEF BEEF BEEF BEEF  BEEF BEEF BEEF BEEF 0001
      created ....: 2017-11-20 00:00:01
Encryption key....: BEEF BEEF BEEF BEEF BEEF  BEEF BEEF BEEF BEEF 0002
      created ....: 2017-11-20 00:00:02
Authentication key: BEEF BEEF BEEF BEEF BEEF  BEEF BEEF BEEF BEEF 0003
      created ....: 2017-11-20 00:00:03
General key info..: pub  rsa4096/BEEFBEEFBEEF0001 2017-11-20 John Doe <john@example.com>
sec>  rsa4096/BEEFBEEFBEEF0001  created: 2017-11-20  expires: never
                                Cardnumber:BEEF BEEF9999
ssb>  rsa4096/BEEFBEEFBEEF0002  created: 2017-11-20  expires: never
                                Cardnumber:BEEF BEEF9999
ssb>  rsa4096/BEEFBEEFBEEF0003  created: 2017-11-20  expires: never
                                Cardnumber:BEEF BEEF9999

Now the blackhole rises. As mentioned in the showcase documentation, PuTTY should work right out of the box. Year right I thought but I gave it a try. Off course it will not work since the OpenSSH server does not know the public part of the authentication key. What a surprise.

However I extracted the required OpenSSH compatible fingerprint to put in .ssh/authorized_keys:

gpg --export-ssh-key BEEFBEEFBEEFBEEFBEEFBEEFBEEFBEEFBEEF0003

The result was an OpenSSH compatible fingerprint with the following comment:

ssh-rsa [...omitted...] openpgp:0xBEEF0003

I reinserted the Yubikey, restart the gpg-agent and retry to login into my OpenSSH server. It also didn't work out.

So I googled again and found another tutorial to use Yubikey as SSH authentication.

I setup the way McQueen Labs recommend it but this also did not work out for me.

There where not any prompt for the card pin or error messages besides No supported authentication methods available (server sent: publickey).

This makes me think that either this kind of SSH authentication is not done by publickey method (which I find less likely) or there is configuration missing.

Which brings me to my question: How to setup PuTTY to use Yubikey OpenPGP authentication? And what do configure on the server side.

Edit: The Yubikey OpenPGP interface works well with Git commits, etc.. But I am not able to use it for SSH authentication.

  • 1
    I just realized I had Keepass with the KeeAgent plugin competing with gpg-agent for putty credential requests. I grew suspicious when the KeePass password window popped up after opening putty... . So double check and make sure you don't have any other pageant running in the background. Working fine for me after disabling the KeeAgent plugin. – baloan Apr 4 '18 at 16:13
  • No Keepass running on the machine. But thanks for the hint. And with Pageant, I have tested both states. – burnersk Apr 5 '18 at 4:55
  • I noted a difference in behaviour after adding the C:\Program Files (x86)\GnuPG\bin and C:\Program Files\PuTTY directories to the PATH. – baloan Apr 6 '18 at 11:27
0

I had the same Problem as describe above with my YubiKey 5 NFC. It seems like putty could not read the config file or pubring.

Changing the home directory for gpg from %APPDATA%\gnupg\ to %HOMEPATH%\gnupg\ solved the problem on my Windows 10.

For checking the home directory for gpg you can put: gpg --version in the command shell. For changing the home directory you can create the environment variable GNUPGHOME with the new home directory

0

There are two ways to accomplish this:

  1. Using YubiKey to store the SSH Authentication key to authenticate against SSH servers
    • This method only supports RSA keys and must be stored in the [A]uthentication slot
    • This method does not require SSH server/client PAM support

  2. Using PuTTY-CAC for authentication using a PKCS11 cert
    • Yubico Configuration: PKCS11
    • PuTTY-CAC Configuration: Connection > SSH > Certificate

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.