ssh on james(bl)og

Setting up NixOS to use an SSH CA

Fri, 03 Mar 2023 21:00:00 +0000

In my previous post I described how to set up an SSH certificate authority using a YubiKey.

I’ve been experimenting with NixOS again recently — having had several failed attempts before due to the utterly impenetrable documentation — but I’m curious enough to spend a bit more effort on it.

Even though I’m only running it in test VMs right now I still want to get a good feel for running it on a server, so I want to be able to log in using a signed certificate.

YubiKey as an SSH Certificate Authority

Fri, 03 Mar 2023 16:00:00 +0000

This is a guide to setting up a YubiKey for use as an offline SSH certificate authority.

This assumes a brand new YubiKey with no prior configuration on it, to be used solely as a CA.

Why?

Typically a CA should be on a secured, isolated machine. Using a dedicated YubiKey means you can isolate your CA and keep it in a drawer so that it can’t be accessed. YubiKeys offer protections such as requiring a PIN and/or touching the key for PIV operations.