V. K. MindHunter86

⚠️ Content below I now consider obsolete. My latest guide is now located here: Technical guide for using YubiKey series 4 for GPG and SSH. Please consult that resource instead.

Quick GPG Smartcard Guide

YubiKey 4 series GPG and SSH setup guide

Written for fairly adept technical users, preferably of Debian GNU/Linux, not for absolute beginners.

You'll probably be working with a single smartcard, so you'll want only one primary key (1. Sign & Certify) and two associated subkeys (2. Encrypt, 3. Authenticate). I've published a Bash function which automates this slightly special key generation process.

NB: This document describles a 'Old-School' way of using Yubikey with SSH

Modern OpenSSH has native support for FIDO Authentication. Its much simpler and should also be more stable with less moving parts. OpenSSH also now has support for signing arbitary files witch can be used as replacement of gnupg. Git also supports signing commits/tags with ssh keys.

Pros of FIDO

Simpler stack / less moving parts
Works directly with ssh, ssh-add and ssh-keygen on most computers
Simpler
Private key can never leave the FIDO device

	##TCP FLAGS##

	Unskilled Attackers Pester Real Security Folks
	==============================================
	TCPDUMP FLAGS
	Unskilled = URG = (Not Displayed in Flag Field, Displayed elsewhere)
	Attackers = ACK = (Not Displayed in Flag Field, Displayed elsewhere)
	Pester = PSH = [P] (Push Data)
	Real = RST = [R] (Reset Connection)
	Security = SYN = [S] (Start Connection)

	package main

	import (
	"bufio"
	"fmt"
	"log"
	"os"
	"syscall"
	"time"
	)

	#!/bin/bash

	LATESTNGINX="1.11.10"
	BUILDROOT="/tmp/boring-nginx"

	# Pre-req
	sudo apt-get update
	sudo apt-get upgrade -y

	# Install deps


	server {
	listen 80;
	server_name your.domain.com;

	location = /analytics.js {
	# you have to compile nginx with http://nginx.org/en/docs/http/ngx_http_sub_module.html (this is not default)
	# and http://nginx.org/en/docs/http/ngx_http_proxy_module.html (it's a default module)

	proxy_set_header Accept-Encoding "";

	[Path]
	PathChanged=/etc/systemd/network/wg0.network
	PathChanged=/etc/systemd/network/wg0.netdev

	[Install]
	WantedBy=multi-user.target

	# Use this script to test that your Telegram bot works.
	#
	# Install the dependency
	#
	# $ gem install telegram_bot
	#
	# Run the bot
	#
	# $ ruby bot.rb
	#

	# References:
	#
	# https://cinhtau.net/2016/12/09/disable-apt-auto-update-and-upgrade/
	# https://unix.stackexchange.com/questions/315502/how-to-disable-apt-daily-service-on-ubuntu-cloud-vm-image
	# https://askubuntu.com/questions/824718/ubuntu-16-04-unattended-upgrades-runs-at-random-times/831206

	apt-get -y purge update-notifier-common ubuntu-release-upgrader-core landscape-common unattended-upgrades

	systemctl kill --kill-who=all apt-daily.service
	systemctl kill --kill-who=all apt-daily-upgrade.service