I'm wondering if it is possible to use a Yubikey to unlock for example a GnuPG key on a server, so can I somehow pass the generated token from the YubiKey over SSH to the server in an easy way?
2 Answers
GnuPG does not make use of any tokens generated by the Yubikey, but the stick implements the OpenPGP smart card protocol instead. The keys are stored on the YubiKey, which performs all public/private key cryptographic operations. The special protection is based on the fact that the keys never can leave the YubiKey, so an attacker could at most make use of the key (temporarily, as long as he has access to the unlocked stick), but not completely get hold of it.
GnuPG has a feature called agent forwarding. It mostly boils down to configure gpg-agent
to provide a special, extra socket only used for specific operations:
extra-socket /home/<user>/.gnupg/S.gpg-agent.extra
Then, configure SSH to forward all communication on the socket to the remote server:
RemoteForward /home/<user>/.gnupg/S.gpg-agent /home/<user>/.gnupg/S.gpg-agent.extra
More explanation including some hints on nitpicks is available in the wiki page linked above.
![](../../users/profiles/19837.webp)
- 23,446
- 12
- 72
- 96
In new versions of GnuPG or Linux distributions the paths of the sockets can change. These can be found out via
$ gpgconf --list-dirs agent-extra-socket
and
$ gpgconf --list-dirs agent-socket
Then add these paths to your SSH configuration:
Host remote
RemoteForward <remote socket> <local socket>
Quick solution for copying the public keys:
scp .gnupg/pubring.kbx remote:~/.gnupg/
On the remote machine, activate GPG agent:
echo use-agent >> ~/.gnupg/gpg.conf
On the remote machine, also modify the SSH server configuration and add this parameter (/etc/ssh/sshd_config):
StreamLocalBindUnlink yes
Restart SSH server, reconnect to the remote machine - then it should work.
A more detailed tutorial including some troubleshooting can be found in a blog post by Matthias Lohr.
![](../../users/profiles/10863.webp)
- 31,973
- 8
- 71
- 135
![](../../users/profiles/179747.webp)
- 121
- 3