search

hwsecurity-sdk / termbot

SSH client that works with YubiKeys, Nitrokeys, and other OpenPGP cards (based on the Hardware Security SDK)
https://hwsecurity.dev/termbot/
Other
83 stars 9 forks source link

PIV security key support #25

Open barde opened 4 years ago

barde commented 4 years ago

Bug description

According to the readme the Yubikey is supported with PIV keys for SSH login: https://hwsecurity.dev/docs/supported-hardware/

When using TermBot only the OpenGPG key is used, tough.

Steps to reproduce

  1. Add Yubikey
  2. Login to server
  3. Prompt for OpenGPG card is opened
  4. No way to chose PIV key on Yubikey

Expected behavior

When adding a Yubikey or other supported hardware device with PIV support by the SDK a dialogue should offer the user a choice which key system is to be used.

Screenshots

N/A

Android device

Server information

Additional context

Thanks a lot that finally someone cared for a solution to login with Yubikeys with smart phones! I waited for years and would gladly pay for being able to use the PIV keys with a ssh client.

dschuermann commented 4 years ago

While the SDK does support PIV, Termbot currently only supports OpenPGP. I haven't figured out a good user interface to decide between PIV and OpenPGP...

barde commented 4 years ago

Idea: when adding the HSM, Termbot checks if OpenGPG and/or PIV keys are available. If more than one key is found, the user can chose the key he wants to add to this SSH key profile.

The key selection screen shows some general information like key name and location, i.e. OpenGPG/PIV.

kaisengit commented 4 years ago

Sorry to bother but is there any news on this? It would be super useful to be able to access the keys stored in the PIV interface

soundspeachy commented 4 years ago

Just want to show additional interest in this request. It would be really great to have PIV support.

MichalSznajder commented 3 years ago

Having PIV would be great. PIV is much simpler than OpenPGP...

xaduha commented 3 years ago

IsoApplet is simpler than either of them, basically all you need for SSH auth without cruft.

sbourdeauducq commented 2 years ago

But it doesn't work with yubikey, does it?

gaspardle commented 1 year ago

I started to add PIV support, https://github.com/gaspardle/termbot/tree/termbot-piv.

Currently only tested with a Yubikey and an RSA certificate.

Screenshot_TermBot3