https://www.half-empty.ca/tags/yubikey/ Recent content in Yubikey on Christopher Hylarides Hugo en-us {{year}} Mon, 25 Nov 2024 12:04:04 -0500 https://www.half-empty.ca/post/yubikey_mac_ssh/ Sun, 24 Nov 2024 18:12:54 -0400 https://www.half-empty.ca/post/yubikey_mac_ssh/ <p>Recently, I decided to give FIDO2-backed ssh keys a go for work and personal use. The theoretical benefits of keeping your private keys secure and irretrevable are pretty compelling in certain use cases.</p> <h4 id="background-on-the-issues-with-yubikeys-and-ssh-on-macos">Background on the Issues with Yubikeys and SSH on MacOS</h4> <p>With modern versions of <a href="https://www.openssh.com/">OpenSSH</a> (8.3+), you can use SSH keys stored in a modern Yubikey that supports FIDO2 (specifically FIDO 2.1 for credProtect, which early versions of Yubikey 5 did not support). This allows you to use the key in an attached Yubikey to authenticate to remote SSH servers, including Linux, GitHub and anything that supports ed25519-sk and ecdsa-sk keytypes (essentially ed25519 and ecdsa keys in a Yubikey or other hardware device). For their own reasons, Apple has the MacOS bundled versions of OpenSSH (including ssh-keygen and ssh-agent) built with support for this disabled (including as of November 2024 with MacOS Sequoia 15.1.1). We can get around this by installing the clients via <a href="https://brew.sh/">Homebrew</a>.</p>