Yubico / developers.yubico.com

Source code for generating our website
https://developers.yubico.com
53 stars 64 forks source link

Yubikey GPG/PIV/FIDO2 SSH auth issues on Windows 11 #511

Open desultory-zz opened 1 year ago

desultory-zz commented 1 year ago

I'm having issues with this tutorial: https://developers.yubico.com/PGP/SSH_authentication/Windows.html I'm running Windows 11 and have a Yubikey5. I've loaded ED25519 certs onto it, and I'm able to see those in gpg-agent but the windows ssh agent is not able to see these keys. I'd also like to point out that the gpg configuration folder is not .gnupg under appdata, but is gnupg. I've even added the keygrip to the sshcontrol file, also not mentioned in the guide and the ssh client still isn't seeing my keys.

desultory-zz commented 1 year ago

I can't get PIV to work either. Your PIV ssh tutorial is also missing the vital information that the the bin folder needs to be added to your user/system path to function. When I run ssh-keygen -D libykcs11.dll -e it gives me an rsa key, and I don't have any RSA keys on this yubikey to begin with. I'm beyond confused by what is happening with my Yubikey, and the extremely disjointed, poor quality wikis aren't helping the situation at all.

desultory-zz commented 1 year ago

Following this guide isn't helpful: https://support.yubico.com/hc/en-us/articles/360021606180-Using-YubiKey-PIV-with-Windows-native-SSH-client# It doesn't say how you should get the key's fingerprint for ssh auth and I don't know where to go from there.

desultory-zz commented 1 year ago

I can use GPG with with KiTTY, but not with the windows SSH client, even if I set the environment variable for %SSH_AUTH_SOCK% to 'C:\Users\{user}\AppData\Local\gnupg\S.gpg-agent.ssh'

What is most concerning is that it's taking the ssh key AAAAC3NzaC1lZDI1NTE5AAAAINliIwfA09BAc8G0e4AIYn6cYbjFUimfDuUKPcvgLQLP but when I run gpg --export-ssh-key {keygrip} I get AAAAC3NzaC1lZDI1NTE5AAAAIAZHFjxkyRTgqb2tMbiEvEkNcg79knqZJfMBjEBtrMq+ and gpg says it's from openpgp;{hexkey} not the yubikey's serial number. I am running into issues at every turn here, https://github.com/tavrez/openssh-sk-winhello/issues/17#issuecomment-1283080980

FirehawkV21 commented 1 year ago

Hello!

I've tested with version 9.2.2.0 of Win32-OpenSSH and I was successful in using my Yubico Security Key for the SSH key.