hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-14 06:12:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

ssh: enable FIDO/U2F keys

Browse Source 
Description of FIDO/U2F support (from OpenSSH 8.2 release notes,
https://www.openssh.com/txt/release-8.2):

  This release adds support for FIDO/U2F hardware authenticators to
  OpenSSH. U2F/FIDO are open standards for inexpensive two-factor
  authentication hardware that are widely used for website
  authentication.  In OpenSSH FIDO devices are supported by new public
  key types "ecdsa-sk" and "ed25519-sk", along with corresponding
  certificate types.

  ssh-keygen(1) may be used to generate a FIDO token-backed key, after
  which they may be used much like any other key type supported by
  OpenSSH, so long as the hardware token is attached when the keys are
  used. FIDO tokens also generally require the user explicitly
  authorise operations by touching or tapping them.

  Generating a FIDO key requires the token be attached, and will
  usually require the user tap the token to confirm the operation:

    $ ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk
    Generating public/private ecdsa-sk key pair.
    You may need to touch your security key to authorize key generation.
    Enter file in which to save the key (/home/djm/.ssh/id_ecdsa_sk):
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in /home/djm/.ssh/id_ecdsa_sk
    Your public key has been saved in /home/djm/.ssh/id_ecdsa_sk.pub

  This will yield a public and private key-pair. The private key file
  should be useless to an attacker who does not have access to the
  physical token. After generation, this key may be used like any
  other supported key in OpenSSH and may be listed in authorized_keys,
  added to ssh-agent(1), etc. The only additional stipulation is that
  the FIDO token that the key belongs to must be attached when the key
  is used.

To enable FIDO/U2F support, this change regenerates ssh_namespace.h,
adds ssh-sk-helper, and sets ENABLE_SK_INTERNAL (unless building
WITHOUT_USB).

devd integration is not included in this change, and is under
investigation for the base system.  In the interim the security/u2f-devd
port can be installed to provide appropriate devd rules.

Reviewed by:	delphij, kevans
Relnotes:	Yes
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D32509
This commit is contained in:
Ed Maste 2021-10-06 23:31:17 -04:00
parent 305ef653bc
commit e9a994639b
5 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
crypto/openssh/ssh_namespace.h
View File

@ -87,6 +87,10 @@
#define chacha_encrypt_bytes Fssh_chacha_encrypt_bytes
#define chacha_ivsetup Fssh_chacha_ivsetup
#define chacha_keysetup Fssh_chacha_keysetup
#define chachapoly_crypt Fssh_chachapoly_crypt
#define chachapoly_free Fssh_chachapoly_free
#define chachapoly_get_length Fssh_chachapoly_get_length
#define chachapoly_new Fssh_chachapoly_new
#define chan_ibuf_empty Fssh_chan_ibuf_empty
#define chan_is_dead Fssh_chan_is_dead
#define chan_mark_dead Fssh_chan_mark_dead
@ -553,8 +557,10 @@
#define ssh_dss_sign Fssh_ssh_dss_sign
#define ssh_dss_verify Fssh_ssh_dss_verify
#define ssh_ecdsa_sign Fssh_ssh_ecdsa_sign
#define ssh_ecdsa_sk_verify Fssh_ssh_ecdsa_sk_verify
#define ssh_ecdsa_verify Fssh_ssh_ecdsa_verify
#define ssh_ed25519_sign Fssh_ssh_ed25519_sign
#define ssh_ed25519_sk_verify Fssh_ssh_ed25519_sk_verify
#define ssh_ed25519_verify Fssh_ssh_ed25519_verify
#define ssh_err Fssh_ssh_err
#define ssh_fetch_identitylist Fssh_ssh_fetch_identitylist
@ -871,6 +877,12 @@
#define sshpkt_start Fssh_sshpkt_start
#define sshpkt_vfatal Fssh_sshpkt_vfatal
#define sshsigdie Fssh_sshsigdie
#define sshsk_add_option Fssh_sshsk_add_option
#define sshsk_enroll Fssh_sshsk_enroll
#define sshsk_key_from_response Fssh_sshsk_key_from_response
#define sshsk_load_resident Fssh_sshsk_load_resident
#define sshsk_open Fssh_sshsk_open
#define sshsk_sign Fssh_sshsk_sign
#define start_progress_meter Fssh_start_progress_meter
#define stdfd_devnull Fssh_stdfd_devnull
#define stop_progress_meter Fssh_stop_progress_meter

2
secure/libexec/Makefile
View File

@ -4,7 +4,7 @@
SUBDIR=
.if ${MK_OPENSSH} != "no"
SUBDIR+=sftp-server ssh-keysign ssh-pkcs11-helper
SUBDIR+=sftp-server ssh-keysign ssh-pkcs11-helper ssh-sk-helper
.endif
SUBDIR.${MK_TESTS}+= tests

16
secure/libexec/ssh-sk-helper/Makefile Normal file
View File

@ -0,0 +1,16 @@
.include <src.opts.mk>
.include "${SRCTOP}/secure/ssh.mk"
PROG= ssh-sk-helper
SRCS= ssh-sk-helper.c ssh-sk.c sk-usbhid.c
MAN= ssh-sk-helper.8
CFLAGS+=-I${SRCTOP}/contrib/libfido2/src
LIBADD= ssh crypto z
.if ${MK_USB} != "no"
LIBADD+= fido2 cbor
.endif
.include <bsd.prog.mk>
.PATH: ${SSHDIR}

6
secure/ssh.mk
View File

@ -1,6 +1,12 @@
# Common Make variables for OpenSSH
.include <src.opts.mk>
SSHDIR= ${SRCTOP}/crypto/openssh
CFLAGS+= -I${SSHDIR} -include ssh_namespace.h
SRCS+= ssh_namespace.h
.if ${MK_USB} != "no"
CFLAGS+= -DENABLE_SK_INTERNAL=1
.endif

2
tools/build/mk/OptionalObsoleteFiles.inc
View File

@ -7141,6 +7141,7 @@ OLD_FILES+=usr/lib32/libprivatessh_p.a
OLD_FILES+=usr/libexec/sftp-server
OLD_FILES+=usr/libexec/ssh-keysign
OLD_FILES+=usr/libexec/ssh-pkcs11-helper
OLD_FILES+=usr/libexec/ssh-sk-helper
OLD_FILES+=usr/sbin/sshd
OLD_FILES+=usr/share/man/man1/scp.1.gz
OLD_FILES+=usr/share/man/man1/sftp.1.gz
@ -7157,6 +7158,7 @@ OLD_FILES+=usr/share/man/man8/pam_ssh.8.gz
OLD_FILES+=usr/share/man/man8/sftp-server.8.gz
OLD_FILES+=usr/share/man/man8/ssh-keysign.8.gz
OLD_FILES+=usr/share/man/man8/ssh-pkcs11-helper.8.gz
OLD_FILES+=usr/share/man/man8/ssh-sk-helper.8.gz
OLD_FILES+=usr/share/man/man8/sshd.8.gz
.endif