search

hwsecurity-sdk / termbot

SSH client that works with YubiKeys, Nitrokeys, and other OpenPGP cards (based on the Hardware Security SDK)
https://hwsecurity.dev/termbot/
Other
83 stars 9 forks source link

U2F/FIDO security key support #27

Open tulir opened 4 years ago

tulir commented 4 years ago

OpenSSH recently got support for using U2F/FIDO security keys for authentication. It would be nice to be able to use such keys when SSHing from Android devices.

https://marc.info/?l=openssh-unix-dev&m=157259802529972&w=2 https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.u2f

lukeross commented 4 years ago

I'm also interested in U2F support for TermBot, and have forked and added some basic support. It's currently reeeally rough, but is good enough for me to be able to log in to an OpenSSH 8.2 server using a blue Yubico NFC Security Key. I plan to try and improve it a bit, time permitting.

Main limitations right now: you must import an existing "sk-ecdsa-sha2-nistp256@openssh.com" key (cannot generate yet), and it must have a password on the imported key. I also think something's not quite right in my use of the hwsecurity UI flow as the on-screen keyboard only kicks in when I press the back button after logging in. To build it requires custom versions of sshlib and hwsecurity :disappointed: - it's on my github if interested.

(Minor detail - I had originally wanted to use the Google Play Services FIDO support, but as far as I can tell it's just not flexible enough to support SSH, being closely tied to WebAuthn)

NullSense commented 3 years ago

@lukeross do you still have those changes? A PR could be possible :). I noticed your profile is inactive, but worth a shot.

lukeross commented 3 years ago

Yes, the changes are still up.

Firstly you'll need to build a hwsecurity lib with some tweaks to permit access to the raw data received from the key:

https://github.com/cotechde/hwsecurity/compare/master...lukeross:master

Then, using the just-built version of hwsecurity, you can build the termbot app with the U2F tweaks:

https://github.com/cotechde/termbot/compare/termbot...lukeross:termbot

[Added later] I think it also needs the sshlib changes to handle key serialisation/deserialisation:

https://github.com/connectbot/sshlib/compare/2.2.14...lukeross:2.2.14-fido

I would suggest that it would want a bit of polishing-up before merging to main branch. I archived the project as I no longer have need of the U2F use-case myself, so don't plan to develop it any further myself.

dschuermann commented 3 years ago

This would be the way to tackle this: