Skip to content

Instantly share code, notes, and snippets.

@emmakat

emmakat/SSH2FA.markdown

Forked from lizthegrey/attributes.rb
Last active November 17, 2023 09:45
Show Gist options
  • Save emmakat/2226e3e5bc94678da77ba7a62c93a9e2 to your computer and use it in GitHub Desktop.
Save emmakat/2226e3e5bc94678da77ba7a62c93a9e2 to your computer and use it in GitHub Desktop.
Download ZIP
Hardening SSH access to Github with TouchID
Raw
SSH2FA.markdown

This is a fork of @lizthegrey excellent gist on securing SSH with 2FA but modified to focus on the first steps one can take toward securing ssh access to Github (or other version control systems) with Apple touch ID button. Designed to prevent key theft from the systems we connect to with 2FA, while maintaining ease of use. From the project "If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed. If you store your keys in the Secure Enclave, it's impossible to export them, by design."

Mac client setup

Use TouchID to authenticate logins to GitHub! Since sekey is no longer maintained, let's use secretive instead.

Install the binary: Assumes homebrew is installed

brew install secretive

Generate a secret requiring authentication:
secretive1

Copy the Public key for use in Github: secretive 2

Prompt for your touchid:
touchid

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment