Up your SSH security game
summary
OpenSSH has supported FIDO2 tokens since 2020 and major forges (GitHub, Forĝejo/Codeberg) accept them; hardware keys store either resident keys (key material stays on the device) or encrypted non‑resident keys, often require a PIN and a physical touch, and limit resident slots to ~32 or 128. Recommended workflow: clone/fetch over HTTPS and configure git’s insteadOf for pushes so only push operations prompt the token. Systemd socket‑activated SSHd can gate root access behind the token. Attestation is vendor‑based (e.g. YubiKey); TPMs work but are harder to set up.
AI-written summary · about
chapters (10)
- 0:00SSH security risks
- 1:43U2F USB keys for SSH
- 4:06Resident vs non-resident SSH keys
- 7:36Security policies with hardware keys
- 8:40Hardware-backed SSH benefits
- 10:25Security versus usability in SSH
- 11:28Systemd SSH proxy use cases
- 12:54Hardware keys vs TPM for SSH
- 13:40Hardware key attestation support
- 14:25Managing SSH keys with tokens
related talks
01h 38mOpenSSH + FIDO Workshop
44mEngineering Secure SSH Access for Engineers
24mStrong Auth Supply Chain
05m“You still use the password after all” – Exploring FIDO2 Security Keys in a Small
50msshlogin: securely authenticating to remote Linux systems via ...- 44mEngineering Secure SSH Access for Engineers
47mWhy FIDO Security Keys & Webauthn are Awesome
27mSSH Keys: Security Asset or Liability?