Use FIDO2 key as SSH host key?

[natanael@slrpnk.net]

You don't want FIDO2 security tokens for that, use an OpenPGP applet (works with some Yubikeys and with many programmable smartcards)

[gozz@lemmy.world]

FYI I got it working, please see the update above.

[gozz@lemmy.world]

I am familiar with these alternatives. My experiment was specific in wanting FIDO2 and I ended up figuring out the issue. It was the intersection of a couple of weird behaviours that made debugging very confusing, but it works exactly as I expected it would once those are resolved. I guess we can consider this a proof of concept that you can indeed use FIDO2 tokens as an external SSH host key (though as I said below whether this is practically useful is another matter entirely).

[jet@hackertalks.com]

That's awesome!

[ricecake@sh.itjust.works]

Unfortunately, I think you're going to run into trouble because fido authenticators are geared towards working as user authenticators rather than as device authenticators.
It certainly should be possible from a technical perspective, but implementation-wise, it's very likely that the code focuses on making fido devices work with client keys, and using tpms for host keys, since that's much more focused on headless server functionality.

Oval peg in a round hole.

[natanael@slrpnk.net]

Your workaround is precisely why I said "more practical". Any updates to your tooling might break it because it's not an expected usecase

[xylogx@lemmy.world]

Looks like this happened:

OpenSSH server has had built-in support for WebAuthn keys since 8.2.

[oisteink@feddit.nl]

Been using this for a while - yubico has a nice guide. Dunno why you struggled to find good info as i can just google «fifo2 ssh» and use the top link

[oisteink@feddit.nl]

Nah - storing cryptographic key pairs is a supported and valid use-case for fido2

[ricecake@sh.itjust.works]

It wasn't the crypto key pair part I was referring to, it was the part where fido is geared towards interactive user auth, not non-interactive storage.
It wouldn't have surprised me if the ssh devs hadn't put implementing fido support for host keys high in the development list, or that it was tricky to find documentation for. Using something like a tpm is the more typical method.

There's no technical reason it can't work, and the op got it to work so clearly the implementation supports it, but that doesn't mean it's the most expected setup, which means it might have unexpected gaps in functionality or terrible documentation.

[oisteink@feddit.nl]

Yeah - i mistook it for user keys, not host. Im guessing they used piv/smart-card and not fido, as fido is indeed made with interactive use in mind