Privileged access using Yubikeys
yubico-piv-tool is needed initially to setup your yubico device. yubico-piv-tool is available with most Linux distributions. It is included in EPEL on RHEL systems. You can also download it using the below link.
https://developers.yubico.com/yubico-piv-tool/Releases/
1. Change PIN
The PIN must be between 6 and 8 characters long, and it can be any type of alphanumeric character.
The default PIN code is 123456.It is important that the default PIN code is changed.
yubico-piv-tool -a change-pin
2. Change PUK
The PUK must be between 6 and 8 characters long, and it can be any type of alphanumeric character.
The default PUK code is 12345678. It is important that the default PUK code is changed.
yubico-piv-tool -a change-puk
3. Change Management Key
The default management key is 010203040506070801020304050607080102030405060708.
key=$(export LC_CTYPE=C; dd if=/dev/urandom 2>/dev/null | tr -d '[:lower:]' | tr -cd '[:xdigit:]' | fold -w48 | head -1)
echo ${key}
yubico-piv-tool -aset-mgm-key -k
4. Generate Keys
yubico-piv-tool -a generate -a verify-pin -a selfsign -a import-certificate -s 9a -k -A RSA2048 --valid-days=3650 -S "/CN=piv_auth/OU=yubikey/O=bnl.gov/" --pin-policy="once"
5. Export SSH public key
yubico-piv-tool --action=read-certificate --slot=9a --key-format=SSH
6. Export Attestation Certificate
yubico-piv-tool --action=attest --slot=9a
7. Export Signing Certificate
yubico-piv-tool --action=read-certificate --slot=f9
Please send output of Step 5 , 6 and 7 to gateway admins.
To Authenticate
On Unix based systems -
Authenticate to the target system using the new key:
ssh -I XXX/libykcs11.so user@remote.example.com
This can also be set up to work with ssh-agent:
ssh-add -s XXX/libykcs11.so
On Windows systems use Putty-cac binaries, see below link.
https://github.com/NoMoreFood/putty-cac/tree/master/binaries/x64
Putty -> Connection -> SSH -> Certificate -> Set Capi Cert
Useful links
https://developers.yubico.com/yubico-piv-tool/YubiKey_PIV_introduction…
https://developers.yubico.com/PIV/Introduction/Admin_access.html