Eugen Mayer EugenMayer

Initial checks

Start by checking that there aren't any previous ssh keys inside the FIDO2 authenticator of your YubiKey. You can check if they exist by running the command below:

nix shell nixpkgs#yubikey-manager -c ykman fido credentials list

If the command above outputs a string mentioning "ssh" or "openssh", then you have already got a key generated and store on your YubiKey.

Evaluating additional authentication factors

Before generating a new ssh key to store on your YubiKey you must consider which additional required authentication factors you want to use. Below you can see a table with the available factors and their corresponding command:

Docker(-compose) with shorewall

The shorewall documentation explains in http://shorewall.org/Docker.html how to configure shorewall for use with docker. The problem with the configuration is that it only allows connections from the host to the main bridge docker0. Connections to other networks on dynamically created bridges, with names starting by default with br-, is blocked. Instead of the recommended contents of /etc/shorewall/interfaces, use wild-card interface names as follows:

#ZONE	INTERFACE	OPTIONS
#dock	docker0		bridge     # disabled default recommendation
dock 	docker0		physical=docker+,routeback=1
dock 	br		physical=br-+,routeback=1

	# /etc/network/interfaces
	#
	auto lo
	iface lo inet loopback

	# device: eth0
	iface eth0 inet manual

	# IPv4 bridge
	# (connect ONLY your firewall/router KVM instance here, this is the WAN device!)

	# /etc/network/interfaces
	#
	auto lo
	iface lo inet loopback

	# device: eth0
	iface eth0 inet manual

	# IPv4 bridge
	# (connect ONLY your firewall/router KVM instance here, this is the WAN device!)