SSH Authentication with Fido2 / Yubico Security Key

Question

I was wondering if it is possible to use FIDO2 to authenticate against an ssh server. There are many tutorials explaining how to use GPG and the newer Yubikeys for ssh auth, but i do not find any information on if it is possible or how it is possbile to use FIDO2 or U2F (especially Yubico Security Key NFC) to authenticate against an ssh server.

Answer 1

Good news! OpenSSH 8.2 has added support for FIDO/U2F. No more need for a patch.

FIDO/U2F Support

This release adds support for FIDO/U2F hardware authenticators to OpenSSH. U2F/FIDO are open standards for inexpensive two-factor authentication hardware that are widely used for website authentication. In OpenSSH FIDO devices are supported by new public key types ecdsa-sk and ed25519-sk, along with corresponding certificate types.

ssh-keygen(1) may be used to generate a FIDO token-backed key, after which they may be used much like any other key type supported by OpenSSH, so long as the hardware token is attached when the keys are used. FIDO tokens also generally require the user explicitly authorise operations by touching or tapping them.

Generating a FIDO key requires the token be attached, and will usually require the user tap the token to confirm the operation:

  $ ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk
  Generating public/private ecdsa-sk key pair.
  You may need to touch your security key to authorize key generation.
  Enter file in which to save the key (/home/djm/.ssh/id_ecdsa_sk): 
  Enter passphrase (empty for no passphrase): 
  Enter same passphrase again: 
  Your identification has been saved in /home/djm/.ssh/id_ecdsa_sk
  Your public key has been saved in /home/djm/.ssh/id_ecdsa_sk.pub

Answer 2

You can use pams provided by yubico.

libpam-yubico for otp authentication can be used. ref

libpam-u2f for u2f (can't be used with ssh since it uses libusb which reads only local ports.)

BTW: You dont need PPA it is already in repo (at least Debian).

Answer 3

This is possible by patching the OpenSSH server and client.

Since this patch is not integrated in the official OpenSSH code and looks pretty hacky, it could contain bugs and vulnerabilities.