-
-
Notifications
You must be signed in to change notification settings - Fork 127
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add -new-key command #95
Comments
Actually, I looked again at #57 and I like the approach of having a separate command better, so let's call this |
Hey @FiloSottile , is there any update on this matter (or a workaround? like locally creating and importing a key?) I have a usage pattern where 20+ auth requests are being made in a row (vscode remote connection) and it is getting a bit burdensome to touch my key 20 times evey couple of minutes. :/ |
Hey @FiloSottile , I needed this pretty badly today, so i opened up setup.go and just tried to replicate the same thing manually via ykman, as a temporary solution until you allow some level of configuration. Leaving a comment here for future reference for anyone who needs help with this :) Also, if you notice that I did something wrong here, please tell me :D
|
Any updates on this? Would really like to be able to have some no-touch functionality and it seems like its tied to this. |
I was looking at the ability to generate a key with cached touch policy, but then I got it by this bug in If you generate a key with At least for me, this is a big no for the cached touch policy. |
The -new-key command generates a new key in one of the numbered "retired" slots with a certificate with CN="SSH key".
The -touch-policy, -pin-policy, and -key-type flags control the respective aspects of this additional key.
There is no way to delete a key with yubikey-agent, instead the README will explain how to use YubiKey Manager for that.
yubikey-agent will support all ECDSA, Ed25519, and RSA keys in the Authorization and retired slots of all connected PIV tokens, as long as they were generated on device and the Common Name of the certificate is
SSH key
. (This allows ignoring age keys, which otherwise would leak to remote SSH servers.)(This will break some current keys generated by other tools, but those were never and won't be officially supported.)
The text was updated successfully, but these errors were encountered: