Questions[yubikey](server)

I am not able to redirect to Yubikey into the VMWare Horizon VDI. the guest OS is Ubuntu 20.04 I have install the vmware client & the required driver with the following command:

sudo ./install_viewagent.sh -m yes -U yes -A yes
sudo apt install yubico-piv-tool yubikey-manager yubikey-personalization-gui libpam-yubico libpam-u2f

I am able to show the Yubikey is inserted with command, but the Yubikey manager cannot detect the device with the GUI. pls find the enclosed screenshot

sudo pcsc_scan

Note: I can redirect the Yubikey to VMWare Player with Ubuntu 20.04 OS with the setting modified in vmx file:

usb.ccid.disable = "TRUE"
usb.generic.allowCCID = "TRUE"
usb.generic.allowHID = "TRUE"
usb.generic.allowLastHID = "TRUE"

I just got some YubiKeys to secure my important accounts and am now wondering about the best way of securing access to some VPS boxes I have. Up until now, I have disabled password-based login and used SSH keys to connect to the servers.

As far as I can tell from some research, there are two ways to secure SSH access with a YubiKey:

1. Generating a ed25519-sk key pair which can only be used together with the YubiKey
2. Using the pam_yubico module on the server to only allow access with a regular SSH key and the YubiKey as a second factor

Is there any reason to prefer one of these over the other for security or convenience?

I just bought a Yubikey a few days back. I have tried to use the key to login to SSL without a password. I have it working, but it displays an error and shows interactive auth prompts.

The only real prompts are the customer and Yubikey one. How can I remove lines 2-4?

I had to recently rebuild my laptop. In the process, I switched from Fedora31 to Kubuntu 20.04 LTS. Everything in the switch went without a hitch, except for one thing. Where I work we use 2FA for all logins, and utilize a yubi key for this purpose. I thought I had everything set-up correctly, but whenever I try to ssh to a server now (and use PIV) I get this error...

Enter passphrase for PKCS#11:  Could not add card
"/usr/lib/x86_64-linux-gnu/libykcs11.so": agent refused operation

Now, every time I reboot the system, etc I have to re-add the card as normal. This shows that it was properly added already.

ssh-add -s /usr/lib/x86_64-linux-gnu/libykcs11.so 
Enter passphrase for PKCS#11: 
Card added: /usr/lib/x86_64-linux-gnu/libykcs11.so

Despite this, it's still throwing that annoying error at me. Now I CAN just manually enter my PW and hit the Yubi and log in. So it's not a show-stopper. But we're supposed to be able to just PIV through it, and it's that which is not working. Annoying.

Thought I had everything set-up correctly, but I guess not. On the old build (prior to rebuild) I did a complete export of all private and public keys, and trusts. On the new system I imported those private & public keys, and the trusts file. I also copied over my ssh configs, etc.

After a TON of Googling, I tried all the remedies I could find, including verifying ownership and permissions on the cert file itself. To my knowledge, this is all correct.

-r--------  1 REDACTED_USER REDACTED_USER  1537 Jan 20  2020 id_rsa-cert.pub

If I do a "ssh-add -l" I do see the proper signature there.

ssh-add -l
2048 SHA256:<<REDACTED>> Public key for Digital Signature (RSA)
2048 SHA256:<<REDACTED>> Public key for PIV Attestation (RSA)

While I redacted it here, I did verify that the sha256 value for the key does match with the servers in question.

So obviously, the problem is a user-induced config issue on my laptop.

Anyone have any thoughts on what the issue could be?

I had a SSH key which I imported without problems in my GPG keyring as auth key using pem2openpgp from monkeysphere. The imported key works fine. I removed its SSH version from ~/.ssh and switched from ssh-agent to gnupg-agent with SSH support. The problem came when I purchased a Yubikey 4 and tried to move sign, encrypt and auth keys into it. All keys are 4k RSA. Sign and encrypt keys, created inside gpg, can be moved wihout issues, while the imported auth key is refused. I always get an "Invalid value" error message. If I create a new auth key - 4k RSA as the imported key, it can be moved without issues. I also tried to export and reimport my auth key from and to gpg keyring, without results. Yubikey support dismissed the case some time ago because a non-imported key works. Replacing my current key would be a lot of work, as I manage many servers. I would prefer avoiding it.

This is the debug log from scdaemon.

2020-03-03 22:39:26 scdaemon[4493] writing new key
2020-03-03 22:39:26 scdaemon[4493] RSA modulus size is 4096 bits
2020-03-03 22:39:26 scdaemon[4493] DBG: send apdu: c=00 i=DB p1=3F p2=FF lc=539 le=-1 em=-254
2020-03-03 22:39:26 scdaemon[4493] DBG:   PCSC_data: ...
2020-03-03 22:39:26 scdaemon[4493] DBG:   PCSC_data: ...
2020-03-03 22:39:26 scdaemon[4493] DBG:  response: sw=6A80  datalen=0
2020-03-03 22:39:26 scdaemon[4493] failed to store the key: Invalid value
2020-03-03 22:39:26 scdaemon[4493] operation writekey result: Invalid value
2020-03-03 22:39:26 scdaemon[4493] DBG: chan_7 -> ERR 100663351 Invalid value <SCD>

Any hint would be appreciated. Thanks in advance.