The Yubikey Neo

What is it and how can you use it to store your SSH credentials?

Transcript

1. Yubikey Neo What is it and what can it do for me?
2. Yubikey Neo It’s a USB/NFC stick that acts as a physical security token • Cross platform • No drivers • Acronyms! ◦ OTP ◦ CCID ◦ U2F
3. What Can I Do With It? • Log into your computer • Improve Password Managers like LastPass ◦ Generate strong passwords ◦ Secure access to password database • Two Factor Auth to various web services • Act as a physical SSH key • Other things!
4. Using it as a U2F token You do have two factor auth enabled on your Google account right? 1. Add the key to your account 2. When you next log in, you’ll be prompted to enter your token. 3. There is no step 3
5. What about SSH keys? Make use of the smart card functionality to store a PKCS11 certificate on the key Generate an SSH public key from this and deploy to target servers SSH will use the opensc libraries to communicate with the key to access your private key
6. SSH: Prerequisites 1. A Unix-y system 2. A Yubikey Neo 3. The opensc and opensc-pkcs11 libraries installed 4. The yubikey-piv-tool installed 5. CCID enabled on the Neo
7. SSH: Generate The Key yubico-piv-tool -s 9a -a generate -o public.pem yubico-piv-tool -a verify-pin -P 123456 -a selfsign-certificate \ -s 9a -S "/CN=SSH key/" -i public.pem -o cert.pem yubico-piv-tool -a import-certificate -s 9a -i cert.pem
8. SSH: Deploy & Use ssh-keygen -D /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so | ssh username@targethostname 'cat >> /ssh/authorized_keys' echo "PKCS11Provider /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so" >> ~/.ssh/config ssh username@targethostname Enter PIN for 'PIV_II (PIV Card Holder pin)':
9. Thank you! Giles Paterson @gilesp