Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor the SSH documentation #120

Open
schaarsc opened this issue Dec 20, 2022 · 0 comments
Open

refactor the SSH documentation #120

schaarsc opened this issue Dec 20, 2022 · 0 comments

Comments

@schaarsc
Copy link

schaarsc commented Dec 20, 2022

File: [pro/linux/ssh.rst] https://docs.nitrokey.com/pro/linux/ssh.html

I'd like to suggest to extend / refactor the SSH documentation

create an Overview page. This allows the re-use of the details for different devices.

SSH key can be protected with different approaches:
* GnuPG agent, in this case one of the sub-keys is used <link to current page>
* ssh with FIDO2, in this case a feature build into OpenSSH is used <link to new page>

the overview page should only list the options supported by the device being documented.

the content of the new page would be something like

FIDO is supported starting with version OpenSSH 8.2p1

* generate a ssh-key: ssh-keygen -t ed25519-sk -O verify-required -O resident -O application="ssh:my-application" -C "my-comment" 
 * resident keys are supported starting with OpenSSH 8.3
 * NOTE: verify-required is not supported by ssh-agent
 * NOTE: libpam-ssh-agent-auth version 0.10.3 does not support these new key types
* download resident keys on different machine: ssh-keygen -K
* the server can request verification by adding "PubkeyAuthOptions verify-required" to sshd_config

the menu would have one additional level

Nitrokey 3
-> Linux
--> SSH Overview
---> SSH with GnuPG Agent
---> SSH with FIDO2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant