summaryrefslogtreecommitdiff
path: root/docs/configuration
diff options
context:
space:
mode:
authorAlex Kudentsov <43482574+alexk37@users.noreply.github.com>2026-01-30 23:54:42 +0700
committerGitHub <noreply@github.com>2026-01-30 16:54:42 +0000
commit741a1f24454bb24ece86a9e3881625d3f6f7b252 (patch)
treeae25a3f0dab05bfce568b6a5d6421999f647d435 /docs/configuration
parent7f1e47753daa6cf7f515b7fb6e70506427c8931b (diff)
downloadvyos-documentation-741a1f24454bb24ece86a9e3881625d3f6f7b252.tar.gz
vyos-documentation-741a1f24454bb24ece86a9e3881625d3f6f7b252.zip
ssh: fix fido2 examples indentation (#1748)
Diffstat (limited to 'docs/configuration')
-rw-r--r--docs/configuration/service/ssh.rst16
1 files changed, 12 insertions, 4 deletions
diff --git a/docs/configuration/service/ssh.rst b/docs/configuration/service/ssh.rst
index 98bce691..11f58201 100644
--- a/docs/configuration/service/ssh.rst
+++ b/docs/configuration/service/ssh.rst
@@ -72,22 +72,30 @@ Configuration
Two FIDO2 key types are supported by OpenSSH: ``ed25519-sk``, ``ecdsa-sk``
Generic FIDO2-backed SSH key generation example:
+
.. code-block:: none
+
ssh-keygen -t ecdsa-sk -O verify-required -C "fido2-ssh-key"
+
During key generation, OpenSSH will:
- * Request user presence (for example, a physical touch or confirmation)
- * Optionally request user verification (PIN), if supported by the authenticator
- * Create a local key handle file and a corresponding public key (``.pub``)
- The private key material never leaves the authenticator device.
+ * Request user presence (for example, a physical touch or confirmation)
+ * Optionally request user verification (PIN), if supported by the authenticator
+ * Create a local key handle file and a corresponding public key (``.pub``)
+
+ The private key material never leaves the authenticator device.
VyOS configuration example:
+
.. code-block:: none
+
# Generate a FIDO2 SSH key on the client system
# Copy the public key to the VyOS instance
set system login user vyos authentication public-keys fido key '<public-key>'
set system login user vyos authentication public-keys fido type 'sk-ecdsa-sha2-nistp256@openssh.com'
set service ssh fido touch-required
+
You can now log into the system using: ``ssh -i ~/.ssh/id_fido_key vyos@192.0.2.1``
+
.. cfgcmd:: set service ssh disable-host-validation
Disable the host validation through reverse DNS lookups - can speedup login