yubikey-agent VS aws-vault

This is a great idea. I now exclusively use SSH keys on hardware security modules of some kind. I use "Secretive", a mac app that does the same, plus a yubikey using yubikey-agent (https://github.com/FiloSottile/yubikey-agent; there are too many complicated ways to use SSH keys with a yubikey this is one of the friendliest ones). Depending on the security and frequency of which I access the service impacts whether I need presence confirmation or use secretive versus the yubikey.

I would be remiss to mention there are existing SSH TPM projects, not sure how this one differentiates. It seems to at least have the user experience pretty simple, similar to yubikey-agent (and secretive), and unlike some of the existing solutions which have quite a few extra steps:

Also check out https://github.com/FiloSottile/yubikey-agent which simplifies the setup quite a bit.

I'm using it on nixOS and macOS, via Nix Packages and Homebrew respectively. It's this - https://github.com/FiloSottile/yubikey-agent I'm realizing from this thread that it's not an official package. I'll go closer to the source with ykman. Thanks!

I think the Ledger Manager only interfaces with the GPG and SSH agents, neither of which age take advantage of. But age does have support for Yubikeys (see https://github.com/FiloSottile/yubikey-agent). If you can interface with the Ledger hardware device as a Yubikey, this might work. I don't have experience here, just a thought.

You can use PIV for SSH just fine.

It's not OpenSSH's weird FIDO mode, but I don't like the FIDO mode anyway because it requires storing a file on the computer.

https://github.com/FiloSottile/yubikey-agent

I have the same concern. I modified Pageant (Windows agent) so that it prompts me before signing anything which helps ease my mind, I only approve when I know I'm connecting to a new server. There are also options like requiring a Yubikey too (https://github.com/FiloSottile/yubikey-agent)

Aging MBP, Intel based, Monterey 12.3.1 uname -v Darwin Kernel Version 21.4.0: Fri Mar 18 00:45:05 PDT 2022; root:xnu-8020.101.4~15/RELEASE_X86_64 brew info yubikey-agent yubikey-agent: stable 0.1.5 (bottled), HEAD Seamless ssh-agent for YubiKeys and other PIV tokens https://filippo.io/yubikey-agent /usr/local/Cellar/yubikey-agent/0.1.5 (7 files, 4.8MB) * ...

Unless I've missed something, SSH keys stored on Yubikeys are still hampered because you aren't allowed to a touch policy of "touch never".

Imagine needing to touch the Yubikey with each "git pull" or using Ansible to operate over SSH on a dozen servers in parallel, and needing to touch the Yubikey once for each server.

The feature request I'm tracking is here: https://github.com/FiloSottile/yubikey-agent/issues/95

The proposed feature would allow setting a touch policy for the SSH key.

If you can do ssh, you can sign messages: https://github.com/FiloSottile/yubikey-agent

Undying fondness for aws-vault to securely cache my session credentials.

you might want to check https://github.com/99designs/keyring and https://github.com/99designs/aws-vault

You install aws-vault (https://github.com/99designs/aws-vault), configure it according to the README and make sure you have an SSO entry that is compatible, i.e.:

I use a aws-vault to switch thought all profiles on all aws account. It support SSO with 2FA.

Nice! Do I understand this correctly?

You use aws-vault(https://github.com/99designs/aws-vault) and configure it with IAM and MFA with YubiKeys. You configure e.g. the profile jonsmith.

When you run

aws-vault exec jonsmith -- aws s3 ls

it will ask you, e.g. every hour to confirm with YubiKeys and cache the key for one hour. After that the temporary keys expire. Can you also store keys different from AWS?

Don't know about kube, but awscli and a few others decouple the idea of getting credentials and doing the actions. You can use the password every time, but a better way is to either use the preconfigured profile or some wrapper which does use the keychain. For example https://github.com/99designs/aws-vault/ supports one-off commands and shell sessions with pre-populated tokens.

It sounds like you have AWS SSO enabled and need a way to run scripts manually in the terminal. Take a look at the aws-vault project that makes it easy working with multiple AWS accounts.

A tool called aws-vault can fix the "insecure" part.

Take a look at aws-vault, which has support for SSO and running in a docker container.

I read the docs on: https://github.com/99designs/aws-vault