YubiKey Setup (Windows)

[mqpickens]

YubiKey and other FIDO2 security hardware devices help keep your node secure, but easily accessible.
Highly recommended for all node setups!

Download/Installl YubiKey software. Required to interface with the Yubikey.

• https://www.yubico.com/support/download/yubikey-manager/
  • # Note: With the YubiKey Manager, all unused YubiKey features can be disabled.
  • # Also, the pin can be changed, and the pin can be reset (erases all stored keys).
  • # Make sure to run software as administrator!

Download/Install Openssh

• The OpenSSH software that is (or can be) natively installed on windows has yet to support Yubikey (as of this writing).
  Yet, a version that does support Yubikey may be downloaded and installed from Microsoft's PowerShell repository:
  https://github.com/PowerShell/Win32-OpenSSH/releases

• # Don't forget to restart the computer!

Stop & Disable sshd Service (from the OpenSSH install)

• # Run as administrator: Windows PowerShell
  • Stop-Service -Name sshd # Stop the sshd service
  • Set-Service -Name sshd -StartupType Disabled # Disable the sshd service

Create Key Pair to YubiKey

• # Run as administrator: Windows PowerShell
  • mkdir $HOME\.ssh; cd $HOME\.ssh # Create .ssh folder and move to it
  • rm $HOME\.ssh\YubiKey*
  • "y" | ssh-keygen -t ed25519-sk -O application=ssh:general -O resident -C "# My YubiKey" -f $HOME/.ssh/YubiKey -N '""'
  • # Watch for "Windows Security" dialog box (outside the powershell): Create/Enter pin (6 or more digits); "Touch your security key."

Restore Key Pair from YubiKey

• # Run as administrator: Windows PowerShell
  • mkdir $HOME\.ssh # There may not be a directory
  • cd $HOME\.ssh
  • ssh-keygen -K -N '""'
  • # Enter pin and "Touch your security key." Note: There's no dialog box this time
  • rm YubiKey*
  • mv id_ed25519_sk_rk_general_*.pub YubiKey.pub
  • mv id_ed25519_sk_rk_general_* YubiKey
  • (Get-Content $HOME/.ssh/YubiKey.pub).replace('ssh:general', '# My YubiKey') | Set-Content $HOME/.ssh/YubiKey.pub # Restores original comment

Display Public Key

• cat $HOME/.ssh/YubiKey.pub

Configure Node Server (if not previously setup)

• Copy the Public Key onto a new line in the file ~/.ssh/authorized_keys

[mqpickens]

If the Yubikey was just setup on your machine, everything should be ready to go. If you are working on a freshly installed
windows machine or on another windows machine, remember to Restore Key Pair from YubiKey

Connect to Your Node via YubiKey (Windows PowerShell)

• ssh -p $PORT $USER@$ADDRESS: -i $HOME/.ssh/YubiKey # The port is optional; default is 22
  • Example: ssh satoshi@micro-node.local -i $HOME\.ssh\YubiKey

• # Watch for "Windows Security" dialog box (outside the powershell): "Touch your security key."

Highly Recommended: Download and Use Windows Terminal
Within "Windows Terminal" you can create a new profile to easily connect and manage your micro node.
Create a "micro-node" profile with the following "Command line":

• %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe ssh -p $PORT $USER@$ADDRESS -i $HOME\.ssh\YubiKey

• Example: %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe ssh satoshi@micro-node.local -i $HOME\.ssh\YubiKey