make .ssh/id_rsa read key from yubikey

Question

I have my ssh keys within a yubikey, I use gpg-agent.conf with something like this:

pinentry-program /usr/local/bin/pinentry-mac
enable-ssh-support
default-cache-ttl 60
max-cache-ttl 120

This helps me to ssh into any host without having the private key in a file like ~/.ssh/id_rsa.

But in some cases, like when using tools like ssh-vault, ansible-vault, etc, they need to read the key on file ~/.ssh/id_rsa therefore wondering if there is a way to call the gpg-agent to retrieve the key when trying to read from the ~/.ss/id_rsa, or other ways to retrieve the private keys.

Answer 1

No, there is no way to get the private key out of a yubikey. This is by design for security reasons.

The way to go with this is to use ssh-agents instead. If they are able to use ssh-agent it is very easy to add your yubikey to it. For OpenSSH its just:

ssh-add -s <your-pkcs11.so>

Then you can just point you software towards the SSH agent.