How to use your Yubikey to log in via SSH to your server

I was coworking with a friend the other day when he saw my Yubikey and asked me if I was using it to store my servers’ SSH keys.

“Can my YubiKey store SSH keys?”, I thought. And I started researching. Well, turns out it doesn’t work that way, but you can use your YubiKey (or any FIDO U2F device, for that matter) to harden your SSH login.

Here’s what we’re trying to accomplish:

1. We try to log in into our machine with SSH

ssh [email protected]

2. The machine asks for YubiKey authentication, even though we have the right SSH private key

ssh [email protected]
> Confirm user presence for key ECDSA-SK SHA256:...

3. You touch your YubiKey

4. You’re in!

ssh [email protected]
> Confirm user presence for key ECDSA-SK SHA256:...
> User presence confirmed

We have effectively added a second factor authentication to our SSH login using our Yubikey’s U2F capabilities.

---

Why would you do this?

Same reason why you add Second Factor Authentication (2FA) to any password-protected account you own.

If an attacker gains access to your user and password, they’d be unable to log in unless they also have access to your hardware key or OTP device you use for 2FA.

Your SSH private key is kind of like a password. Only that you store it in your hard drive. So anyone who hacks into your computer could access all servers that private key is configured to.

I’ve been tinkering with crypto stuff lately, so my mental model is that storing your SSH private key in your hard drive is kind of like having a hot wallet. Pretty secure most of the time, but you’re done if someone gets access to your computer – which is plausible, since your computer is connected to the internet and the internet is full of bad actors. Adding a multi factor authentication with a Yubikey makes it more like a cold wallet. Part of the secret key is stored in an independent hardware device that’s not connected to the internet and that’s designed not to leak the key.

Adding a Yubikey 2FA to your SSH login is interesting for several reasons:

• It’s resistant to data leaks / data being stolen. Even if your computer or backups get accessed to, compromising the SSH private keys, attackers can’t access the servers.
• It’s resistant to phishing attacks. You can’t reveal what you don’t know.
• It’s resistant to digital hacks. The attacker would need physical access to the key.

The only possible attack would be a targeted attack. Someone would have to single you out, know which servers you access to, what’s the SSH certificate you use to access them, somehow steal that private key AND then get physical access to your Yubikey to gain access of the servers. It’s not impossible, but it’s definitely more secure than not having the Yubikey additional protection in place.

How to configure your Yubikey to protect your SSH login with 2FA

And we’re done!

Conclusion

SSH is a secure way of accessing servers. But if your private key gets compromised, an attacker can gain access to your servers.

Adding Second Factor Authentication (2FA) with a hardware security key like Yubikey is a good option to strengthen your SSH setup, because attackers would need to get physical access to your hardware key on top of having your SSH private key.

OpenSSH >= 8.2 adds the capability of creating 2FA-compatible SSH key pairs of type ecdsa-sk and ed25519-sk.

Setting up a few 2FA-enabled SSH key pairs is pretty straightforward and can be done in just a few minutes – saving you lots of headaches in the event your computer is hacked or your private key gets leaked.

P.S.: Follow me on Twitter to stay in the loop. I'm writing a book called Bold Hackers on making successful digital products as an indie hacker. Read other stories I've written. Subscribe below to get an alert when I publish a new post: