Securing SSH with the YubiKey (2024)

FAQs

How to secure SSH with YubiKey? ›

Other 2FA methods typically only send you a six-digit code to confirm your identity, mostly because it would be unreasonable to expect humans to type much more than that. YubiKeys don't require you to manually enter a code, so they're free to use much longer codes. That's more secure.

The YubiKey 5 FIPS certified security keys meet the highest level of assurance (AAL3) of the new NIST SP800-63B guidelines.

ssh\id_ed25519 on Windows). We strongly recommend using only the ed25519 algorithm (an ECDSA variant). It is the most secure SSH key type widely available, and is very well supported in the majority of systems. If you are using an client or server without ed25519 support, you should consider upgrading where possible.

From a security standpoint, using SSH-keys to authenticate a user's identity leads to greater protection of your data. Username/password authentication can often lead to security compromises, in particular, brute force attacks by hackers.

SSH Passwordless Login FAQ

If you simply press Enter without typing a passphrase, the key will be created without one. While this allows for passwordless authentication, it is important to note that such a key is less secure because it can be used by anyone who obtains the private key.

SSH keys are used for authentication, enabling secure access to servers and other network devices. However, when SSH keys fall into the wrong hands, they can be used to gain unauthorized access to systems, steal data, and cause other security issues.

Is SSH actually secure? ›

SSH is "secure" because it incorporates encryption and authentication via a process called public key cryptography. Public key cryptography is a way to encrypt data, or sign data, with two different keys. One of the keys, the public key, is available for anyone to use.

First, keys are more difficult to set up and maintain than passwords. You need to generate, distribute, and store your keys securely, and update them regularly. Second, keys can pose a security risk if they are lost, stolen, or compromised.

Do I need to keep my yubikey plugged in all the time? A. No, you only need to insert your yubikey when you are prompted to do so during login. Leaving it plugged in could result in the yubikey being lost or damaged.

Yubico always recommends adding two keys to each of your online services and accounts; one primary and one secondary as backup in case the primary is lost.

A Yubikey will essentially last forever, and if you stay clear of the insanity that is Passkeys its Webauthn element can support an infinite number of websites. Portability: I have a smartphone, a work laptop, a home laptop, and a home desktop. My Yubikey has USB and NFC, so it can trivially be used with all of them.

We strongly recommend using only the ed25519 algorithm (an ECDSA variant). It is the most secure SSH key type widely available, and is very well supported in the majority of systems. If you are using an client or server without ed25519 support, you should consider upgrading where possible.

SSH private keys are the crown jewels of remote access and a stolen key is a severe risk. Intruders can use stolen keys to impersonate users, access sensitive data, and take total control of a system.