diff options
| author | Andrii Pidnebesny <58984788+AnDroed09@users.noreply.github.com> | 2026-01-20 17:28:47 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-01-20 15:28:47 +0000 |
| commit | 759fd06565a69b03d6706aed9d1c87be486ab63c (patch) | |
| tree | 53796d57de3c0c5f512f620bcc3a93f46cdb4951 /docs/configuration | |
| parent | 6cb2ba4c8dcb53430703fc10bc5d4d09e4b74df6 (diff) | |
| download | vyos-documentation-759fd06565a69b03d6706aed9d1c87be486ab63c.tar.gz vyos-documentation-759fd06565a69b03d6706aed9d1c87be486ab63c.zip | |
ssh: T7483: Document fido2 add examples pair fido key with the VyOS (#1738)
* Update ssh add fido example.rst
* remove useless "$" ssh.rst
* add generation example ssh.rst
* add generation example ssh.rst
Diffstat (limited to 'docs/configuration')
| -rw-r--r-- | docs/configuration/service/ssh.rst | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/docs/configuration/service/ssh.rst b/docs/configuration/service/ssh.rst index 4bb5af95..98bce691 100644 --- a/docs/configuration/service/ssh.rst +++ b/docs/configuration/service/ssh.rst @@ -68,6 +68,26 @@ Configuration Require FIDO2 keys to attest that a user is physically present. + VyOS supports SSH authentication using FIDO2-backed keys generated by OpenSSH. + Two FIDO2 key types are supported by OpenSSH: ``ed25519-sk``, ``ecdsa-sk`` + + Generic FIDO2-backed SSH key generation example: + .. code-block:: none + ssh-keygen -t ecdsa-sk -O verify-required -C "fido2-ssh-key" + During key generation, OpenSSH will: + * Request user presence (for example, a physical touch or confirmation) + * Optionally request user verification (PIN), if supported by the authenticator + * Create a local key handle file and a corresponding public key (``.pub``) + The private key material never leaves the authenticator device. + + VyOS configuration example: + .. code-block:: none + # Generate a FIDO2 SSH key on the client system + # Copy the public key to the VyOS instance + set system login user vyos authentication public-keys fido key '<public-key>' + set system login user vyos authentication public-keys fido type 'sk-ecdsa-sha2-nistp256@openssh.com' + set service ssh fido touch-required + You can now log into the system using: ``ssh -i ~/.ssh/id_fido_key vyos@192.0.2.1`` .. cfgcmd:: set service ssh disable-host-validation Disable the host validation through reverse DNS lookups - can speedup login |