Revision 16 as of 2021-01-22 16:38:15

Clear message

Passwords

One time passwords Mobile

One time passwords Desktop

Use SSH

Change codes

To use this, it's recommended that you put a PIN, a PUK and a management code on your Yubikey. To do this, start the GUI, or use the following commands:

ykman piv change-pin
ykman piv change-puk
ykman piv change-management-key

The default codes for a new Yubikey are:

For more info about PIN, PUK, and Management keys, follow this link

Generate certificates

Now making the Yubikey understand SSH. Generate the private key, certificate and the public SSH-key.

ykman piv generate-key -a RSA2048 9a pubkey.pem

ykman piv generate-certificate -d 1826 -s "SSH Key" 9a pubkey.pem

ssh-keygen -i -m PKCS8 -f pubkey.pem > pubkey.txt

Configuration

Debian

Make sure yubikey-manager and opensc-pkcs11 is installed:

sudo apt-get install yubikey-manager opensc-pkcs11 

Add on top to your SSH config file ~/.ssh/config:

PKCS11Provider /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so

Archlinux

Add on top to your SSH config file ~/.ssh/config:

PKCS11Provider /usr/lib/opensc-pkcs11.so

Mac OS X

For MacOSX, there's more to do:

brew install opensc

sudo ln `brew list opensc |grep lib/opensc-pkcs11.so` /usr/local/lib/opensc-pkcs11.so

PKCS11Provider /usr/local/lib/opensc-pkcs11.so

And that's enough to make ssh possible.

SSH Agent

To be found out.

Disk Encryption

LUKS

Source

LUKS is the standard for Linux disk encryption, and can easily be installed while setting up a system using i.e. the Debian installer. During LUKS setup, set a 'normal' passphrase, this can be used as a backup for when you lose your yubikey. Furthermore, the following installation has to be executed on the running system, so you'll need the passphrase to unlock the disk before continuing.

More information


CategoryHardware