Just as you use a key to open your front door, you should use this key to gain access to your servers over SSH. The only plausible attack is physical theft with the device, which is mitigated by making the device ask for a PIN or fingerprint and wiping itself after a few wrong attempts.Įssentially it is like a physical key to the digital world. Nobody can steal your password or private key either, since it’s on the device itself and extracting it is impossible. Since the device authenticates to a specfic realm (server address/URL/etc), an attacker can’t reuse one site’s authentication on another site, which makes phishing impossible. The benefit of using a device like this including eliminating phishing, password theft, authentication replay, and lots of other attacks. The private SSH key should be useless to a malicious user who does not have access to the physical YubiKey on which the second private key is stored.

This means you have to explicitly authorize a new SSH session by tapping the YubiKey.

YubiKey is a hardware security key which provides Universal 2nd Factor (U2F) cryptographic tokens through a USB and/or NFC interface. YubiKey suits much better for this purpose by making your SSH keys much more secure while maintaining a great user experience. A better option is to use encrypted usb key but leaving inserted and unsealed usb key for a long time is insecure, while inserting it and removing it back and forth all the time is tedious. Using A Yubikey For SSH Authentication Intro Why do we need this?Īnswer is simple – Security! Alternatives include storing private keys directly on a workstation – which makes them poorly protected in multitude of attacks.

Yubikey linux