Yubikey smartcard & challenge mode usable on remote ssh

Hi,

I’m trying to use my Yubikey 5 key on a remote SSH session using SSH Agent Forwarding.

I read and configure my yubikey key using the excellent tutorial of dr Duh : https://github.com/drduh/YubiKey-Guide

  • I encounter the bug of missing .gnupg, corrected by using mkdir .gnupg
  • i copy paste my local pubring.kbx to remote .gnupg/pubring.kbx
  • ssh-add -l return without problem the yubico key.pub on remote

BUT

  • gpg --card-status doesn’t work and return :

gpg: selecting card failed: No such device
gpg: OpenPGP card not available: No such device

So i miss something on complex Agent Fwd part of this tutorial : https://github.com/drduh/YubiKey-Guide#remote-machines-agent-forwarding

I need that for LUKS decryption of my data-volume using my yubikey slot 2 configured on challenge mode response on slot 2.

LOCAL PART

I add this to my local .zshrc configuration on my local 19.04 ubuntu :

export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
gpg-connect-agent updatestartuptty /bye > /dev/null

I add this to .gnupg/gpg-agent.conf configuration on my local ubuntu :

enable-ssh-support
default-cache-ttl 300
max-cache-ttl 999999

I connect using ssh -A remoteVPS as equivalent to ForwardAgent = yes option

REMOTE NIX PART

The remote configuration part of nix for gnupg

        services.openssh.enable = true;
        users.users.root.openssh.authorizedKeys.keys = ["YubicoGPGKey"];

        services.pcscd.enable = true;
        services.udev.packages = [ pkgs.yubikey-personalization ];

        programs.ssh.startAgent = false;

        programs.gnupg.agent.pinentryFlavor = "curses";
        programs.gnupg.agent = { enable = true; enableSSHSupport = true; };

        services.openssh.extraConfig = ''StreamLocalBindUnlink yes'';

What i miss ? How could i debug ?

That is not necessarily an oversight, the issue is that communication between gpg and pcscd and the smartcard is notoriously unreliable nowadays. Usually restarting pcscd a couple of times helps.

Yubikey supports pkcs11 lib now.
I use that without gpg agent

Interesting @fzakaria , i see that, using PIV, but i don’t found any tutorial to do that with LUKS at boot. Do you have some nix to share ?

Hum, i see that here : https://github.com/NixOS/nixpkgs/issues/85127

I’m using 20.09pre242769.61525137fd1 (Nightingale), so normally these bug doesn’t occur ?

I also try to stop and start without success, very annoying.

After some debugging with journalctl -xe and some googling i found that will be a nightmare :

2020-09-09 21:43:06 scdaemon[2795] pcsc_list_readers failed: unknown PC/SC error code (0x8010002e)

But normally, as they said here (https://github.com/NixOS/nixpkgs/issues/85127) we don’t need pscv activated, so if i desactivate, i have this (no service … yes i know, i desactive it ) :

2020-09-09 21:59:48 scdaemon[3326] pcsc_establish_context failed: no service (0x8010001d)

OK, whatever, the problem seem linked to FW agent which doesn’t work for other thing than ssh-add, i add some new things :

REMOTE gpg.conf

use-agent

LOCAL gpg-agent.conf

extra-socket /home/myhome/.gnupg/S.gpg-agent-extra
debug-level guru
debug-all
log-file /tmp/gpg-agent.log

I also try manually using :

ssh -A myremotehost -R /run/user/0/gnupg/S.gpg-agent:/home/myuserhome/.gnupg/S.gpg-agent

Will try this tomorow : https://callanbryant.co.uk/blog/how-to-get-the-best-out-of-your-yubikey-with-gpg/#ssh-authentication

Perhaps someone, like @srhb could help me by sharing part of their nix ?

This is wtf.

I need that for LUKS decryption of my data-volume using my yubikey slot 2 configured on challenge mode response on slot 2.

I’m not sure it’s even possible to do what you’re asking.

  • You can forward the ssh agent (just make sure that SSH_AUTH_SOCK on the remote host was created by openssh, not by gpg).

  • You can forward a gnupg agent over SSH to do gpg signing/encryption on a remote host (this requires extra configuration).

  • But to forward the yubikey challenge/response protocol over SSH - I have never heard of that.

I’ll try and print the pkcs11 setup I’ve done once I’m back at my laptop.

2 Likes

SSH supports PKCS#11 natively; RedHat has a decent article on it
https://access.redhat.com/articles/1523343

You can simply add the private key to your SSH agent

ssh-add -s /usr/lib64/pkcs11/opensc-pkcs11.so

The use SSH like normal!
You can reference that library from the opensc package in Nixpkgs

❯ nix-locate opensc-pkcs11.so

opensc.out
/nix/store/ph1shins1f7y70cr146fyy6v1aq5m62k-opensc-0.20.0/lib/pkcs11/opensc-pkcs11.so

Just write a handy-dandy alias

alias load_key="ssh-add -s ${opensc}/lib/pkcs11/opensc-pkcs11.so"
1 Like

It’s unclear to me, @reyman, if you’re actually using the Yubikey-specific challege/response mode, or if you’re using the Yubikey OpenPGP app with GnuPG in Linux, per the guide you posted (drduh/YubiKey-Guide).

If its the Yubikey challenge-response, you can’t forward that as far as I know.

If you want to encrypt/decrypt remotely with GPG, this is the simple, reliable guide to follow: https://mlohr.com/gpg-agent-forwarding/. That will show how to forward the gpg socket over SSH. I use this on NixOS with other NixOS hosts and non-NixOS hosts. If you use gpgconf remotely and locally to determine the right paths, things tend “to work”.

@colemickens

I use the Yubikey as OpenPGP smartcard mode.

  • SSH connection using gpg-agent and key created and stored into yubikey (as smartcard) works
  • typing ssh-add -l on remote after connection works and return 4096 SHA256:xxx cardno:xxx (RSA)

BUT anything linked to detection of smartcard, like gpg --smart-status, gpg --card-edit don’t work, this is strange, no ?

drduh/YubiKey-Guide say, on the FWD agent part :

You should now be able use ssh -A remote on the local machine to log into remote , and should then be able to use YubiKey as if it were connected to the remote machine.

Perhaps the Yubikey challenge-response (configured on slot 2) cannot be FWD, but reading the drduh guide, it seems possible to access some smartcard functionalities during/on remote.

Edit : i try the tutorial mlohr (old way to do that, if i read correctly the drduh tutorial), using directly RemoteForward on command line -A -R, also without success :

ssh -A xxx -R /run/user/0/gnupg/S.gpg-agent:/run/user/1000/gnupg/S.gpg-agent

Thanks for your help

I don’t think the challenge-response protocol can be forwarded. Therefore the nixos setting boot.initrd.luks.devices.<name?>.yubikey will not work for you.

SSH and gnupg will work remotely due to agent forwarding (and I think this is what DrDuh is referring to). So you could possibly use GPG agent forwarding and the boot.initrd.luks.gpgSupport setting to unlock your encrypted disk.

1 Like

--card-status and other card operations specifically don’t work over the extra socket meant for forwarding. See the error near the bottom here: https://blog.alt255.com/post/gpg_forwarding/

On the remote, import your gpg public key, then check gpg --list-secret-keys and see if they’re loaded.

And +1 to what @rvl said.

(example removed - this example was removed, it was slightly mistaken, I’ve linked a better example in my next reply)

Ok, so if it’s not possible to use smartcard possibilities, the rest of my config works well.

I’m not using the same method, because yubikey is/contain the private key, so
gpg --list-secret-keys return nothing on my case.

Without yubikey connected on local i cannot connect because i use gpg-agent to manage/replace ssh-agent (i also ask some details to dr duh here with my exact config https://github.com/drduh/YubiKey-Guide/issues/212)

I see that fwd works by adding / removing yubikey and see the output of ssh-add -l. When connected, the command return smartcard number with rsa

PS: I understood from drduh that the StreamLocalBindUnlink=yes option is for remote and not local.

No, I’m sorry for any confusion; the smartcard can be used for decryption and encryption operations remotely. However, things like --card-status do not work. My gpg authentication key is used for SSH as well.

I did forget that I had the private key on this machine for that example, my mistake. But I assure you, it still works. I can show an example in a bit.

EDIT: Okay, this one shows there are no private keys on either machine, and shows decryption working with forwarding: https://gist.github.com/colemickens/0fd5ba0300ca69d17d40119f03b527f8

Hi @colemickens

Yep, i have the same worflow, ssh-add -l show on remote that my smartcard is correctly fwd and ready to decrypt/encrypt … but the life is not so simple :confused:

I try to reproduce the end of your workflow in gist, the encrypt/decrypt part that i never test before…

But i first had some bug/problem (https://github.com/NixOS/nixpkgs/issues/72597) with gpg-agent pinentry not spawing in “ncurse” mode correctly with systemd (don’t know why) and now when i try to encrypt on remote …

gpg: WARNING: server 'gpg-agent' is older than us (2.2.12 < 2.2.20)
gpg: Note: Outdated servers may lack important security fixes.
gpg: Note: Use the command "gpgconf --kill all" to restart them.
gpg: problem with the agent: Forbidden
gpg: error creating passphrase: Operation cancelled
gpg: symmetric encryption of 'test.txt' failed: Operation cancelled

Edit, linked to pinentry


gpgconf --check-programs
gpgconf: error running '/nix/store/yvnd02rbdsin2waamh9kb94klipajbhi-gnupg-2.2.20/bin/pinentry': probably not installed

I install pinentry using configuration.nix, but path don’t correspond and gpg encrypt/decrypt continue to failed :

'/nix/store/aba4by40pyv40gd780px1ivcskdnsd1g-pinentry-1.1.0' from 'https://cache.nixos.org'...

A bug ?

Arg 2 hours lost for that :frowning:

Don’t found the problem with gpg, i open an issue here :

Just another tip: SSH Agent forwarding is completely unrelated to forwarding the GPG Agent socket. ssh-add -l working on remote means nothing about GPG-agent forwarding.

Even when i use gpg-agent to manage ssh like here => https://github.com/drduh/YubiKey-Guide#ssh ?

Yes. I am using a very similar setup as that article. If you are trying to use GPG to decrypt a file on a remote host, SSH forwarding is completely uninvolved.

You can see my gpg-agent config here: https://github.com/colemickens/nixcfg/blob/55eca45719c7dace75040e376b081d265dde765e/mixins/gpg-agent.nix

Interestingly, just last night, I was complaining about problems with gpg-agent where I had to reboot before pinentry would work. (But in that case, pinentry is being done locally, so if local encryption works, then remote should work once forwarding has been done properly.)

EDIT: to extend the demo I showed in the gist above, here I show me decrypting a file remotely WITHOUT -A, so you can see that the gpg forwarding is unrelated to ssh forwarding:

ssh -o "RemoteForward $rpath:$lpath" cole@192.168.1.155  gpg -d /tmp/test.txt.gpg
gpg: encrypted with 4096-bit RSA key, ID 0x62556A61E301DC21, created 2018-05-22
      "Cole Mickens <cole.mickens@gmail.com>"
this is a test
1 Like

Hi there, some news on that, someone answer on DrDuh yubikey issue (https://github.com/drduh/YubiKey-Guide/issues/212) that everything was possible (really ?). I doubt about the “challenge/response”, but i will try …

Actually the bug on pinentry is a problem to investigate more this, but nothing new on this point :