yubikey-agent
authelia
Our great sponsors
yubikey-agent | authelia | |
---|---|---|
15 | 174 | |
2,564 | 19,523 | |
- | 3.2% | |
0.0 | 9.9 | |
5 months ago | 2 days ago | |
Go | Go | |
BSD 3-clause "New" or "Revised" License | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
yubikey-agent
-
Show HN: SSH-tpm-agent – SSH agent for TPMs
This is a great idea. I now exclusively use SSH keys on hardware security modules of some kind. I use "Secretive", a mac app that does the same, plus a yubikey using yubikey-agent (https://github.com/FiloSottile/yubikey-agent; there are too many complicated ways to use SSH keys with a yubikey this is one of the friendliest ones). Depending on the security and frequency of which I access the service impacts whether I need presence confirmation or use secretive versus the yubikey.
I would be remiss to mention there are existing SSH TPM projects, not sure how this one differentiates. It seems to at least have the user experience pretty simple, similar to yubikey-agent (and secretive), and unlike some of the existing solutions which have quite a few extra steps:
-
Secretive: Store SSH Keys in the Secure Enclave
Also check out https://github.com/FiloSottile/yubikey-agent which simplifies the setup quite a bit.
-
Yubikey ssh keys with Ansible, wants to be touched constantly
I'm using it on nixOS and macOS, via Nix Packages and Homebrew respectively. It's this - https://github.com/FiloSottile/yubikey-agent I'm realizing from this thread that it's not an official package. I'll go closer to the source with ykman. Thanks!
-
Is it possible to use AGE with a Ledger hardware device?
I think the Ledger Manager only interfaces with the GPG and SSH agents, neither of which age take advantage of. But age does have support for Yubikeys (see https://github.com/FiloSottile/yubikey-agent). If you can interface with the Ledger hardware device as a Yubikey, this might work. I don't have experience here, just a thought.
-
Cloudflare Hardware Keys (Yubico Partnership)
You can use PIV for SSH just fine.
It's not OpenSSH's weird FIDO mode, but I don't like the FIDO mode anyway because it requires storing a file on the computer.
https://github.com/FiloSottile/yubikey-agent
-
Am I the only one who's nervous when SSH-agent forwarding?
I have the same concern. I modified Pageant (Windows agent) so that it prompts me before signing anything which helps ease my mind, I only approve when I know I'm connecting to a new server. There are also options like requiring a Yubikey too (https://github.com/FiloSottile/yubikey-agent)
-
Failed to fetch key with ECDSA keys via libykcs11.dll
Aging MBP, Intel based, Monterey 12.3.1 uname -v Darwin Kernel Version 21.4.0: Fri Mar 18 00:45:05 PDT 2022; root:xnu-8020.101.4~15/RELEASE_X86_64 brew info yubikey-agent yubikey-agent: stable 0.1.5 (bottled), HEAD Seamless ssh-agent for YubiKeys and other PIV tokens https://filippo.io/yubikey-agent /usr/local/Cellar/yubikey-agent/0.1.5 (7 files, 4.8MB) * ...
-
How to Store an SSH Key on a Yubikey
Unless I've missed something, SSH keys stored on Yubikeys are still hampered because you aren't allowed to a touch policy of "touch never".
Imagine needing to touch the Yubikey with each "git pull" or using Ansible to operate over SSH on a dozen servers in parallel, and needing to touch the Yubikey once for each server.
The feature request I'm tracking is here: https://github.com/FiloSottile/yubikey-agent/issues/95
The proposed feature would allow setting a touch policy for the SSH key.
- FreeBSD SSH Hardening
-
Yubikey PIV encrypted messaging system
If you can do ssh, you can sign messages: https://github.com/FiloSottile/yubikey-agent
authelia
-
Keycloak SSO with Docker Compose and Nginx
It's me and two others though I'm definitely the most active. We put a lot of effort into security best practices and one of my co-developers is currently reviewing the 4.38.0 release. It's a fairly major release with a lot of important code paths that have been improved for the future.
Our official docs can be found at https://www.authelia.com and you can find docs for a particular PR in the relevant PR. We've also linked the pre-release docs in the pre-release discussions which can be found here: https://github.com/authelia/authelia/discussions/categories/...
-
Protecting WebUI on public IP?
I use NGINX proxy with Authelia in between. Authelia blocks and blacklists faulty logins.
-
Why would anyone need AD/AAD when you can manage devices through Saltstack?
https://github.com/saltstack/salt https://github.com/chocolatey/choco https://github.com/nextcloud https://github.com/authelia/authelia https://github.com/grafana/grafana
- Give this project some luv: Single Sign-On Multi-Factor portal for web apps
-
HAProxy with Forward Auth to Authentik
If you are using HAProxy on PfSense/OPNSense, see my issue https://github.com/authelia/authelia/issues/2696
- Keycloak – Open-Source Identity and Access Management Interview
-
LDAP or AD for selfhosted
https://github.com/lldap/lldap is a very simple and lightweight LDAP solution. Works flawless with https://www.authelia.com/
-
Authelia/SSO With Caddy In Docker Compose?
Ah yeah, so I guess it's been a while since I tried and I forgot where I got stuck last time. Authelia's config.yml is absolutely massive and I'm not sure which section of their guide I should be following. In The Docker Compose section, there's "Unbundled", "Lite", and "Local". I think I want to be running the "lite" bundle, but their example compose file has a ton of Traefik stuff in it. I know I wouldn't keep the Traefik services, but do I need either secure or public?
-
How do you secure your webpages that have no protection?
Authelia supports SSO. If you are behind a reverse proxy it’s quite straightforward to integrate.
-
GitLab behind Authelia
This should probably also be mentioned in the documentation so maybe consider mentioning this on their discussion page.
What are some alternatives?
wsl-ssh-agent - Helper to interface with Windows ssh-agent.exe service from Windows Subsystem for Linux (WSL)
authentik - The authentication glue you need.
aws-vault - A vault for securely storing and accessing AWS credentials in development environments
Keycloak - Open Source Identity and Access Management For Modern Applications and Services
age-plugin-yubikey - YubiKey plugin for age
oauth2 - Go OAuth2
win-gpg-agent - [DEPRECATED] Windows helpers for GnuPG tools suite
oauth2-proxy - A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers.
ssh-audit - SSH server & client security auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)
Nginx Proxy Manager - Docker container for managing Nginx proxy hosts with a simple, powerful interface
piv-agent - An SSH and GPG agent which you can use with your PIV hardware security device (e.g. a Yubikey).
dex - OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors