search

tavrez / openssh-sk-winhello

A helper for OpenSSH to interact with FIDO2 and U2F security keys through native Windows Hello API
GNU Lesser General Public License v3.0
187 stars 14 forks source link

You don't need this package anymore #19

Open vova-lantsov-dev opened 4 months ago

vova-lantsov-dev commented 4 months ago

Just want to share my experience with you. At the time of creating this issue, the latest version of OpenSSH on Windows is 9.5

> ssh -V
OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2

Here's an up-to-date article on how to install the latest OpenSSH, setup a FIDO2 and generate SSH key: https://www.upyesp.org/posts/winwdows-ssh-mfa-fido2-yubikey/

Now OpenSSH comes with FIDO2 support built-in, so you don't need to use any external plugins. Here's how I generated my SSH key:

ssh-keygen -t ed25519-sk -O resident -O verify-required -O user=USER -C "any comment here" -f $env:USERPROFILE\.ssh\id_ed25519_sk

Feel free to modify the following options: -O user=USER — replace USER with any name you want, like user=Vova for my name. As long as -O resident is set, all your keys will be stored physically on the FIDO2 security key. So specifying name will help you to distinct multiple keys and store them simultaneously. -O application=ssh:server1 — default application name will be ssh:, you can distinct the keys by application name as well, in this case server1 can be your server's domain.

I guess the only reason to use this package nowadays is to work with WSL (I'm not sure, don't have experience with this)

tavrez commented 4 months ago

Hi, Thanks for the report. Yes I'm aware of this, that's why I haven't updated this for newer versions of OpenSSH :) All of this project functionalities are now inside the libfido2.

I should update the readme files to reflect this.

AlanaRm-rf-me commented 3 months ago

I also wanted to add this - we're all github users..

How has no one tried git bash? As that was my work around, but seeing this, thank you so much. As there's been so many people that I've been trying to help out that are like asking me why I'm installing git bash on their computer because they already have git desktop I'll go ahead and test this out on my 5C tonight though thank you so much for sharing this

EDIT: By the way WSL doesn't work, though I am unsure if its because you need to enable their hyper V features on the new win11 update because I use to have no problem having my usb pass through. Now it does have issues.