6 ms·

How do you authenticate from a machine that isn't local to you? I don't do any work on my work-issued laptop, I use a powerful remote machine instead.

visualphoenix 3y ago
If the remote host is trusted, you just forward the gpg-agent over ssh to your remote host.
- pipe_connector 3y ago
  Sorry, I think I missed something because the article doesn't mention GPG at all. How can you make a webauthn client defer to gpg-agent?
  - pxc 3y ago
    When GPG is your ssh agent, you can use RSA or ed25519 keys stored on a smartcard (like a Yubikey) to authenticate via SSH. It's generally preferable to use a `-sk` key type, though, by which the remote server can essentially enforce that you're using a smartcard and not a normal keypair backed by a file.
    - pipe_connector 3y ago
      Sure, I understand how to authenticate to my remote machine with a smartcard (and already do use this setup). I'm wondering how to authenticate to resources (over HTTP) from my remote machine while using webauthn.
      - walth 3y ago
        Just -D 8080 on your SSH connection and use the local SOCKS5 proxy to tunnel all local web traffic via remote machine.
deleted 3y ago
[deleted]
johncolanduoni 3y ago
Newer openssh clients and servers can use FIDO2-augmented private keys (these are the key types like ed25519-sk). Basically you have a normal keypair stored on the client device, plus the server requires a passing a FIDO2 challenge against the yubikey.
- pipe_connector 3y ago
  Maybe I'm just missing something, let me explain: I've already ssh'd to my work machine. I want to send an HTTP request to my company's internal web API from that machine, but we only use webauthn credentials. I'm going to use curl to send the request to the web API. With basic username/password auth or totp it's easy for me to write a script that prompts me for my password/totp code and marshals in into the expected format. How do I do this with my FIDO2 private key in a way that doesn't completely undermine the whole process?
  - johncolanduoni 3y ago
    The usual process is for your script to do an OAuth flow on an embedded web server with Okta or whatever, and to port forward that embedded server to your client machine. VS code remote handles this pretty well for example.
  - androidbishop 3y ago
    I'm not sure you can. If it is possible, it probably requires some open-source tools and a pretty painful process to get the credentials off a hardware token (if that's even possible) and go through the various API calls. Maybe there's something here? https://github.com/herrjemand/awesome-webauthn https://github.com/herrjemand/awesome-webauthn https://github.com/Yubico/yubikey-manager https://github.com/Yubico/yubikey-manager
  - deng 3y ago
    No, you cannot do a Webauthn authentication with curl. You would need to redirect to a Javascript-capable browser to do the authentication, and then use whatever the service returns as a token with curl (cookie, JWT, ...). I mean, we already have this problem with stuff like OAuth2. Usually, at some point in the process, you will need to enter your credentials in some JS-capable browser.
deng 3y ago
In your ssh config: Host my-trusted-powerful-remote-machine.whatever.com ForwardAgent yes There is still one problem if you like to re-use long-running screen/tmux sessions, for a solution to this see for instance https://gist.github.com/martijnvermaat/8070533 https://gist.github.com/martijnvermaat/8070533
- pipe_connector 3y ago
  Doesn't this only solve the problem for resources I am accessing over SSH? What about if I wanted to access something over HTTP like my web browser does?
  - deng 3y ago
    That is correct. If you actually use a browser remotely, you would need to use something like RDP with the WebAuthn Virtual Channel enabled, which unfortunately I think is currently only available by Microsoft. Some remote control software like Teamviewer has USB passthrough, but I've no idea if that works with Yubikeys (I doubt it). So yes, working with what I'd call a "thin client setup" is something where Yubikeys are probably not a good fit, unless the protocol for that setup would support some kind of direct USB forward that actually works with Yubikeys...
  - stevekemp 3y ago
    Install a HTTPS? proxy on the work-machine, and configure the other host to use that? All requests would then route via the work-computer. But honestly? Use the work computer, and if it isn't good enough ask for a better machine and let somebody else take care of it.
  - NovemberWhiskey 3y ago
    But seriously what do you do for that case if the resource requires password authentication via an OIDC redirect or whatever?

visualphoenix 3y ago

If the remote host is trusted, you just forward the gpg-agent over ssh to your remote host.

pipe_connector 3y ago
Sorry, I think I missed something because the article doesn't mention GPG at all. How can you make a webauthn client defer to gpg-agent?
- pxc 3y ago
  When GPG is your ssh agent, you can use RSA or ed25519 keys stored on a smartcard (like a Yubikey) to authenticate via SSH. It's generally preferable to use a `-sk` key type, though, by which the remote server can essentially enforce that you're using a smartcard and not a normal keypair backed by a file.
  - pipe_connector 3y ago
    Sure, I understand how to authenticate to my remote machine with a smartcard (and already do use this setup). I'm wondering how to authenticate to resources (over HTTP) from my remote machine while using webauthn.
    - walth 3y ago
      Just -D 8080 on your SSH connection and use the local SOCKS5 proxy to tunnel all local web traffic via remote machine.

deleted 3y ago

[deleted]

johncolanduoni 3y ago

Newer openssh clients and servers can use FIDO2-augmented private keys (these are the key types like ed25519-sk). Basically you have a normal keypair stored on the client device, plus the server requires a passing a FIDO2 challenge against the yubikey.

pipe_connector 3y ago
Maybe I'm just missing something, let me explain: I've already ssh'd to my work machine. I want to send an HTTP request to my company's internal web API from that machine, but we only use webauthn credentials. I'm going to use curl to send the request to the web API. With basic username/password auth or totp it's easy for me to write a script that prompts me for my password/totp code and marshals in into the expected format. How do I do this with my FIDO2 private key in a way that doesn't completely undermine the whole process?
- johncolanduoni 3y ago
  The usual process is for your script to do an OAuth flow on an embedded web server with Okta or whatever, and to port forward that embedded server to your client machine. VS code remote handles this pretty well for example.
- androidbishop 3y ago
  I'm not sure you can. If it is possible, it probably requires some open-source tools and a pretty painful process to get the credentials off a hardware token (if that's even possible) and go through the various API calls. Maybe there's something here? https://github.com/herrjemand/awesome-webauthn https://github.com/herrjemand/awesome-webauthn https://github.com/Yubico/yubikey-manager https://github.com/Yubico/yubikey-manager
- deng 3y ago
  No, you cannot do a Webauthn authentication with curl. You would need to redirect to a Javascript-capable browser to do the authentication, and then use whatever the service returns as a token with curl (cookie, JWT, ...). I mean, we already have this problem with stuff like OAuth2. Usually, at some point in the process, you will need to enter your credentials in some JS-capable browser.

deng 3y ago

In your ssh config: Host my-trusted-powerful-remote-machine.whatever.com ForwardAgent yes There is still one problem if you like to re-use long-running screen/tmux sessions, for a solution to this see for instance https://gist.github.com/martijnvermaat/8070533 https://gist.github.com/martijnvermaat/8070533

pipe_connector 3y ago
Doesn't this only solve the problem for resources I am accessing over SSH? What about if I wanted to access something over HTTP like my web browser does?
- deng 3y ago
  That is correct. If you actually use a browser remotely, you would need to use something like RDP with the WebAuthn Virtual Channel enabled, which unfortunately I think is currently only available by Microsoft. Some remote control software like Teamviewer has USB passthrough, but I've no idea if that works with Yubikeys (I doubt it). So yes, working with what I'd call a "thin client setup" is something where Yubikeys are probably not a good fit, unless the protocol for that setup would support some kind of direct USB forward that actually works with Yubikeys...
- stevekemp 3y ago
  Install a HTTPS? proxy on the work-machine, and configure the other host to use that? All requests would then route via the work-computer. But honestly? Use the work computer, and if it isn't good enough ask for a better machine and let somebody else take care of it.
- NovemberWhiskey 3y ago
  But seriously what do you do for that case if the resource requires password authentication via an OIDC redirect or whatever?