Thomas Witt thomaswitt

Setting up Yubikey with SSH and Git on Windows 10 + Powershell

Based on the following guides:

Install dependencies

Install Gpg4win
Install PuTTY

Automatic updates with yum-cron

If you are on RHEL make sure optional repos are enabled:

subscription-manager repos --enable rhel-7-server-optional-rpms

Then install yum-cron:

OpenALPR for Ubuntu 18.04

This is a slightly modified update to Daniel Kornev's excellent post which goes into more detail about why building from source is necessary on 18.04. His post was missing a few dependencies that I didn't have installed namely cmake, opencv and pkg-config. The following steps should get you a working build of openalpr on a fresh install of Ubuntu 18.04.

If you're not working with a fresh install, this might be a good time to clean and update your system before proceeding. (Optional)

$ sudo apt update #fetch list of available updates
$ sudo apt upgrade #install updates – does not remove packages

NB: This document describles a 'Old-School' way of using Yubikey with SSH

Modern OpenSSH has native support for FIDO Authentication. Its much simpler and should also be more stable with less moving parts. OpenSSH also now has support for signing arbitary files witch can be used as replacement of gnupg. Git also supports signing commits/tags with ssh keys.

Pros of FIDO

Simpler stack / less moving parts
Works directly with ssh, ssh-add and ssh-keygen on most computers
Simpler
Private key can never leave the FIDO device

Cons of FIDO

Setting up ssh public key authentication on macOS using a YubiKey 4

I largely followed Florin's blog post, but have a few notes to add regarding issues I encountered:

Basic setup notes

I used a YubiKey 4, while the blog describes using a YubiKey NEO. I'm sure a YubiKey 5 would also work. I'm also running macOS 10.13.6.
I installed GPGTools as recommended. However, as I'll note later, it seems that gpg-agent only automatically starts when gpg is used; for ssh, you'll need to ensure it's running.
Before generating your keys, decide what key size you want to use. If you run the list command inside gpg --edit-card, look for the Key attributes line to see what is currently selected. On my YubiKey 4, it defaulted to 2048 bits for all keys:

Key attributes ...: rsa2048 rsa2048 rsa2048

	# edit the login message
	vi /etc/motd

	# switch to usable repos - iSH defaults often failed with EOF errors
	echo https://dl-cdn.alpinelinux.org/alpine/v3.13/main > /etc/apk/repositories
	echo https://dl-cdn.alpinelinux.org/alpine/v3.13/community >> /etc/apk/repositories

	# install some basics
	apk add zsh bash
	apk add sed attr dialog dialog-doc bash bash-doc bash-completion grep grep-doc

	#!/usr/bin/python
	from enum import Enum
	import time
	import requests
	import RPi.GPIO as GPIO

	# For this package see gist: https://gist.github.com/flxkid/2c8af86d51dc3532b6e0a085b8727e48
	from TCS34725 import TCS34725
	from colormath.color_objects import sRGBColor, LabColor
	from colormath.color_conversions import convert_color

	'''
	Copyright 2019 Alan Newcomer

	Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

	The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. For referenced software, check for specific copyright and licenses.

	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, A

	#!/bin/bash
	sudo yum install gcc -y
	sudo yum install openssl-devel -y
	sudo yum install zlib-devel -y
	sudo yum install mlocate -y
	sudo yum install autoconf -y
	wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.1p1.tar.gz
	tar zxvf openssh-9.1p1.tar.gz
	cd openssh-9.1p1 && ./configure && make && sudo make install

	package main

	import (
	"encoding/json"
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/secretsmanager"
	)

	type SecretData struct {