From 4f40b8ea2f224132dddde4f505191c3662620741 Mon Sep 17 00:00:00 2001 From: Igor Soarez Date: Sun, 25 Oct 2026 17:56:18 +0200 Subject: yubikey-git: opt a host in to git over ssh at git.soarez.net with the YubiKey git key; ssh entry includes enabled.d/ --- config/ssh/entry | 12 ++++++++---- config/ssh/yubikey-git/config | 25 +++++++++++++++++++++++++ config/ssh/yubikey-git/id_ed25519_sk_git | 9 +++++++++ config/ssh/yubikey-git/id_ed25519_sk_git.pub | 1 + config/ssh/yubikey-git/known_hosts | 1 + 5 files changed, 44 insertions(+), 4 deletions(-) create mode 100644 config/ssh/yubikey-git/config create mode 100644 config/ssh/yubikey-git/id_ed25519_sk_git create mode 100644 config/ssh/yubikey-git/id_ed25519_sk_git.pub create mode 100644 config/ssh/yubikey-git/known_hosts (limited to 'config') diff --git a/config/ssh/entry b/config/ssh/entry index e1b6994..a8cdf2b 100644 --- a/config/ssh/entry +++ b/config/ssh/entry @@ -7,15 +7,19 @@ # a set of machines. First, so host-key pinning # there cannot be undone by anything read after # it. -# 2. ~/.config/ssh/config-local This host only; not in any repo, never +# 2. ~/.config/ssh/enabled.d/ Configs from this repo that a host opted in +# to, as links: bin/yubikey-git enable puts +# one here. +# 3. ~/.config/ssh/config-local This host only; not in any repo, never # synced. See config/ssh/config-local-example. -# 3. Shared defaults, below Last, so either of the above can override them. +# 4. Shared defaults, below Last, so any of the above can override them. # -# Both includes are optional: ssh skips an Include that matches no file, so on a -# machine with neither this file configures nothing at all. No key is named +# Every include is optional: ssh skips an Include that matches no file, so on a +# machine with none of them this file configures nothing at all. No key is named # anywhere; ssh's default ~/.ssh/id_ed25519 is whatever that machine installs. Include ~/.config/ssh/config-fleet +Include ~/.config/ssh/enabled.d/*.conf Include ~/.config/ssh/config-local # Shared defaults for every host go here, under `Host *`. There are none yet. diff --git a/config/ssh/yubikey-git/config b/config/ssh/yubikey-git/config new file mode 100644 index 0000000..a878c92 --- /dev/null +++ b/config/ssh/yubikey-git/config @@ -0,0 +1,25 @@ +# git over ssh to git.soarez.net with the YubiKey git key: git clone +# git@git.soarez.net:sz/.git, one touch of the key per fetch or push. +# +# Read only on a host that opted in: `yubikey-git enable` links this file into +# ~/.config/ssh/enabled.d/, which config/ssh/entry includes. See bin/yubikey-git. +# +# The key is id_ed25519_sk_git beside this file, a FIDO2 key whose private half +# never leaves the YubiKey. The file is only its handle: useless without the +# YubiKey, and the YubiKey signs nothing without a touch. git.soarez.net accepts +# it for git on the repositories and nothing else. + +Host git.soarez.net + User git + IdentityFile ~/.ssh/id_ed25519_sk_git + IdentitiesOnly yes + # Pinned, not learned: on a machine we do not trust, the first connection is + # exactly the one an attacker would intercept. + HostKeyAlias git.soarez.net + StrictHostKeyChecking yes + UserKnownHostsFile ~/.config/ssh/yubikey-git/known_hosts + # Never share a connection: a master left open would let anything on this + # machine fetch or push without a touch. + ControlMaster no + ControlPath none + ForwardAgent no diff --git a/config/ssh/yubikey-git/id_ed25519_sk_git b/config/ssh/yubikey-git/id_ed25519_sk_git new file mode 100644 index 0000000..1dfc9cb --- /dev/null +++ b/config/ssh/yubikey-git/id_ed25519_sk_git @@ -0,0 +1,9 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2 +gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACCwffHChtXGxpXW4ot5J5QgCuVzZQish4mCeejc +CV7CmgAAAARzc2g6AAAA8NofV7LaH1eyAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2 +9tAAAAILB98cKG1cbGldbii3knlCAK5XNlCKyHiYJ56NwJXsKaAAAABHNzaDoBAAAAgLrY +C5HJdImLKhBgt4VkfTVjThXtUYWSCSrSJlO0o+ljm07iqPzc60Z8A8lKVrmw4lUd0wMjv0 +R25REIhhh+A+whxQK4mVl2mLDZk1qt0OoO0tEVR7TKydUaBR/Mk1nZHAb++a7WB/oFZGd6 +N+WSsiUNg0xtorBq/Od79olI/0RyAAAAAAAAABB5dWJpa2V5LTEyNTk1NTk5AQ== +-----END OPENSSH PRIVATE KEY----- diff --git a/config/ssh/yubikey-git/id_ed25519_sk_git.pub b/config/ssh/yubikey-git/id_ed25519_sk_git.pub new file mode 100644 index 0000000..be46ed8 --- /dev/null +++ b/config/ssh/yubikey-git/id_ed25519_sk_git.pub @@ -0,0 +1 @@ +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILB98cKG1cbGldbii3knlCAK5XNlCKyHiYJ56NwJXsKaAAAABHNzaDo= yubikey-12595599 diff --git a/config/ssh/yubikey-git/known_hosts b/config/ssh/yubikey-git/known_hosts new file mode 100644 index 0000000..0f62b4b --- /dev/null +++ b/config/ssh/yubikey-git/known_hosts @@ -0,0 +1 @@ +git.soarez.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJCkJM1OCp6YZeNJ4iVBhU66aLAXJTKerkbDzSmVVkvJ -- cgit v1.2.3