sm-Fifteen

"What the heck is a Yubikey and why did I buy one?": A user guide

(EDIT: Besides Reddit, I've also put this up on Github Gist)

So while looking for information on security keys before getting one myself, I got very confused reading about all the different modes and advertised features of Yubikeys and other similar dongles. The official documentation tends to be surprisingly convoluted at times, weirdly organized and oddly shy about a few of the limitations of these keys (which I'm making a point of putting front and center). Now that I have one, I decided to write down everything I figured out in order to help myself (and hopefully some other people reading this) make sense of all this.

Since I'm partly writing these notes for myself, there might be some back and forth between "exp

Vigrond

Setting up Jellyfin and Chromecast using Docker, Nginx, and dnsmasq

1/03/2023

• Requirements
• Guide Specific Requirements
• Installing Docker
• Installing Jellyfin and Nginx
• Set up our DNS server
• Block Chromecast's hardcoded DNS server

thelastlin

Tested on macOS Sonoma Developer beta 2 (23A5276g)

Build libsk-libfido2.so

Prerequisite

1. Download openssh-portable source code, install libcrypto, libfido2;
2. Configure openssh-portable build system by ./configure # [options].

Apply patch

jaybuidl

SSH + Yubikeys via FIDO2 on MacOS

Resources

• Official instructions
• Firmware capabilities matrix
• FIDO2 features by firmware

Prerequisites

Yubikey firmware should be >5.2.3

arianvp

Native Secure Enclave backed ssh keys on MacOS

It turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys! This replaces projects like https://github.com/maxgoedjen/secretive

There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support to ssh by implementing PKCS11Provider interface. However since recently it also implements SecurityKeyProivder which supports loading keys directly from the secure enclave! SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to your Secure Enclave instead!