#165

A closer look at the YubiKey hardware security token, how it works, the CLI and GUI, and how it can be used with a range of services. Also demonstrate how to setup with Wasabi Cloud Storage - an example of a service that supports 2-factor authentication but not specifically the YubiKey.

Notes

I first heard about the YubiKey hardware security key on Security Now! Podcast #143 - from way back in May 2008.

YubiKey 5 NFC

Multi-protocol support: FIDO2, U2F, Smart card, OTP, OpenPGP 3
Interface: USB-A, NFC
IP68 rated: dust tight and water submersible

Services

See Works with YubiKey catalog for full list of currently supported services.

Some of the services I’ve personally used the YubiKey with…

Google Account Login
- yubico: Google Accounts
- Google: Use a security key for 2-Step Verification
- Tested:
  - MacOS High Sierra / Chrome browser
  - MacOS High Sierra / Firefox browser
GitHub
- yubico: GitHub
- GitHub: Configuring two-factor authentication
- enable 2FA with Google Authenticator app, then can add Yubikey as a security key
- Tested:
  - MacOS High Sierra / Chrome browser
  - MacOS High Sierra / Firefox browser
Wasabi Cloud Storage
- not a documented/supported integration, but can use OATH
KeepassXC - cross-platform, open-source password manager successor to the original KeePass

YubiKey Manager (ykman) CLI & GUI

The YubiKey Manager (ykman) is a cross-platform application for configuring any YubiKey. It provides an easy way to perform the most common configuration tasks on a YubiKey, such as:

Displaying the serial number and firmware version of a YubiKey
Configuring a FIDO2 PIN
Resetting the FIDO applications
Configuring the OTP application. A YubiKey has two slots (Short Touch and Long Touch). This tool can configure a Yubico OTP credential, a static password, a challenge-response credential or an OATH HOTP credential in either or both of these slots.
Manage certificates and PINs for the PIV application
Swap the credentials between two configured slots
Enable and disable USB and NFC interfaces

Installation

pip install --user yubikey-manager

The installation directory was not on the path, so added:

export PATH="$PATH:$HOME/.local/bin"

ykman info

$ ykman list
YubiKey 5 NFC (5.2.7) [OTP+FIDO+CCID] Serial: ########
$ ykman info
Device type: YubiKey 5 NFC
Serial number: ########
Firmware version: 5.2.7
Form factor: Keychain (USB-A)
Enabled USB interfaces: OTP, FIDO, CCID
NFC transport is enabled.

Applications  USB     NFC
FIDO2     Enabled Enabled
OTP       Enabled Enabled
FIDO U2F  Enabled Enabled
OATH      Enabled Enabled
OpenPGP   Enabled Enabled
PIV       Enabled Enabled

YubiKey Manager (ykman) GUI

The YubiKey Manager (ykman) GUI is a cross-platform application that provides a graphical user interface for managing most YubiKey features (a subset of what can be managed wuth the ykman command line tool)

yubikey_manager

OATH

The YubiKey supports OATH that in turn can be used to authenticate with a wide range of services that support MFA - see the 2FA Directory

Wasabi Cloud Storage

Wasabi Cloud Storage is an example of a service that supports MFA, but doesn’t have any direct integration or support for the YubiKey.

Here’s my run-through to see how easy it is to setup.

First I installed Yubico Authenticator (aka yubioath-desktop) on my laptop. This provides a GUI tool for managing OATH accounts. The GUI is optional - this could all be done from the command line, however the GUI specifically assists with:

automatically capturing the QR code presented on the Wasabi MFA setup page
provides a simple double-click to trigger auth prompt to generate code for completing MFA setup

In the Wasabi MFA setup page I turned on MFA and used the Yubico Authenticator to scan the QR code from the page:

wasabi-mfa-enable

This adds the account in the Yubico Authenticator (actually, it is stored on the YubiKey):

wasabi-add-account

After using the Yubico Authenticator to generate two codes that need to be added to the Wasabi MFA setup page, MFA is enabled:

wasabi-mfa-enabled

Now when returning to Wasabi, I am prompted for MFA token:

wasabi-mfa-prompt

I need to insert my YubiKey and use the Yubico Authenticator to initiate touch code generation to get a code I can paste into the sign-in screen:

wasabi-yubico-authenticator

Alternatively, codes can be generated from the command line instead of using the Yubico Authenticator GUI:

$ ykman oath accounts list
Wasabi Technologies:root-account-XXXXXXXXXXX@wasabi.com
$ ykman oath accounts code wasabi
Touch your YubiKey...
Wasabi Technologies:root-account-XXXXXXXXXXX@wasabi.com  739330

See OATH_Commands for more info.

Project Notes