วีดีโอ

If you set too many wrong pin in your gpg key, the problem is that the PGP key cannot be recovered, if generated inside the key (if the PGP was generated outside then loaded in youbikey can be reuploade) You can use standard PGP/GPG command (or a GUI program like kleopatra in windows) to delete previous key and create another one. Then you can use the new one wihtout any problem. In programs like Kleopatra to manage yubikey you should go to the Smartcard section (the key is seen like a smartcard) Then you should update public registry and your contact that the old pgp key is now lost, (usually you can have also a revoke certificate, but usually it is enough to update public registry)

Just download yubikey manager and you can reset the pin www.yubico.com/support/download/yubikey-manager/

Deployment name is the name you gave to the deployment in Azure. Model id is the model (gpt3.5 etc). ServiceId is used to register with keyed names

Update: I guess it has something to do with git.autofetch that performs a fetch every 3 minutes automatically. Very annoying since I would have to either turn off autofetch, or switch to a no-touch-required key, but that is currently not supported with resident keys due to a known bug with openssh.

I only use powershell so I never had this problem, I'll investigate

I'll check tomorrow

@@codewrecks nvm. fix the formatting issue and it's working fine. sensitive YAML :(

@@Ajmal_Yazdani I've tried and in my windows machine it runs just fine, if you like, please do a Pull Request against the repository so I can view what does not work? Also which system you are using? Thanks a lot for the help.

@@codewrecks Hi it is working for me as well. It was a YAML format issue.

There is no way to Reset the PIN, resetting the pin will remove all credentials inside the key, so the key starts again like a blank key. This is a security feature that avoid anyone to use the key without the pin.

If I understood the question, probably is lack of permission on the tenant, or wrong tenant (you need to use tenant used by the office365 subscription)

What error message do you got? The video is quite old but the way keycloak interact with the key should be always the same.

@@codewrecks When I inserted my yubikey, I got "passkey registration result is invalid. AbortError: the operation was aborted" in firefox web browser, and I got "Passkey registration result is invalid. NotAllowed Error: The operation either time out or was not allowed." Here is my setup, I created a new realm and bind webauthn browser, cookie(alternative), kerberos(disabled), identity provider redirector(alternative), webauthn browser forms (alternative), username Password Form (required), webauthn authenticator (required), required actions session: webauthn register enable and set it as default, disable webauthn register paswordless, policies session: everything is default, for users session, webauthn register is required

Actually it is long time that I've not worked on keycloak (I've used for an old project). Does the browser ask you for yubikey access or the error appears immediately? (that video is for an old version of keycloak after passkeys introduction I suspect that something changed)

@@codewrecks Yes, when it asked for my yubikey access, once I touch the yubikey, the error message popped up

@@codewrecks When I inserted my yubikey, I got "passkey registration result is invalid. AbortError: the operation was aborted" in firefox web browser, and I got "Passkey registration result is invalid. NotAllowed Error: The operation either time out or was not allowed." Here is my setup, I created a new realm and bind webauthn browser, cookie(alternative), kerberos(disabled), identity provider redirector(alternative), webauthn browser forms (alternative), username Password Form (required), webauthn authenticator (required), required actions session: webauthn register enable and set it as default, disable webauthn register paswordless, policies session: everything is default, for users session, webauthn register is required

That is the reason why I live YubiKey, they come with a really good software that allows you to do everything, also deleting single FIDO 2 credentials

I'm glad to hear that the package is now more eco-friendly. I've ordered a single key directly in Google store from Italy and I got the big package.

You need to use the Azure subscription used by your Office 365 subscription.

Correct, I've not made physical comparison, it will be the subject of another short, actually yubikey is the thinner I have.

It's not 'alot' thicker but it is slightly thicker and slightly longer but still very manageable and not noticeable on a keyring in your pocket.

I need also to redone from scratch, images for docker changed during the years, this is indeed an old video :(

when you create the SSH key you can use -O no-touch-required, I must be honest, never tried because I always like giving a physical confirmation, but that option should disable the requirement for touch.

For windows In RDP it can be remoted, sadly enough it does not work for other devices, so I agree: if you are constantly using lots of device you access remotely, it is complex to use Hardware Keys. The same happens if you have lots of Linux Virtual Machines and have Hyper-V or other virtualization software that does not pass correctly access to USB.

What type of Windows terminal do you use when making these Yubico videos?

Standard Windows terminal plus oh my posh.

Those sites usually uses device login, where the TV gives you a code you need to enter in a web page, where you can use your YubiKey to login. So you can use everywhere it is supported.

ah - got it - Thanks so much - Appreciate your videos !

Yes :D, actually Chat GPT is enabled to create a python script to execute code, if you ask to download scripts, it will create another script that is used to create the Download package for generated script :).

Actually I've a Macbook air M1, so I can try to register something on Mac OS.

You can use a browser like Firefox focus

You can download and install yubikey manager, www.yubico.com/support/download/yubikey-manager/

When, near the end of the video, you enter the PIN with the Yubikey, is it the PIN for the YubiKey or the Windows PIN?

@@TonyJNR123 Yubikey!

Thanks

Having the ability to reset the account is always a good thing, but you need to keep those codes really secure. Actually i have 4 keys registered for all of my important accounts, one key is in a safe place in the house. :)

I'm not a mac user, but sadly enough I've tried with standard RDP client by Microsoft on a Macbooc Air M1 and it does not work, even if you have the option to share the smar card, something seems just not to work and when you try using the key you got an error. I've read online that someone got it to work with other RDP client, but honestly I never tried. I'll investigate

I need to install latest version and update the video. I suspect that it can be old now...

That would be amazing ​@@codewrecks. Please do so

@@codewrecks Could you please update the video? Looks like it is old, please??? I need the updated one urgently. Thanks a lot

Just try with online services :), OpenAI / Cohere, etc. Also local embedding models really need small GPU to run on decent speed, they are really small compared to an LLM.

No it is not needed.

Thank you

Glad it was helpful!

The result is the very same, RDP works the same in both w10 and 11 regarding yubi and the location does not matter

@@codewrecks Yes I guess it works on baremetal. Have you tried it on VM host like on XCP-ng where you have to passthrough the Yubikey ?

It does not depend on virtualization system, remote desktop protocol is part of windows and does not care if the machine you are connecting to is on bare metal, hyper-v, ESxI or whathever.

@@computerguy1893 how do you enable the yubikey in the remote system for it to ask during the rdp session i thought it is only available for enterprise solutions with active directory, if i want to configure yubikey in a windows 11 pro with local account could i configure it somehow to use yubikey thru rdp?

The video is really old, if I had time I'll try to find another image suitable for such a scenario

Glad you like them!

@@codewrecks hey my friend , i bought key 1 week ago and i dont have PIV options enabled , i can only click on FIDO2 , so i dont have even acces to set PUK , any help ?

​@NowyPolus which model of key have you bought? It seems to me you have bought basic security key th-cam.com/video/TABDv9436RI/w-d-xo.html

@NowyPolus which version of the key you have? It seems you have the basic security key and not the 5 version

You need to copy the shim private key, but if you create a resident key, you just need your yubikey. You use the command line utility to extract the key. th-cam.com/video/jYb7l7mbhLM/w-d-xo.htmlsi=CaecHRQoAMyyGFLi

If you want to let your user log in only on VPN it should be possible, but never tried honestly

Thanks, following official documentation (developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html) the private key should be stored inside the key. … The first file, id_ecdsa_sk, contains a reference to the private key credential stored on the YubiKey. The second file ,id_ecdsa_sk.pub, contains the public key

I do not own an iPhone, so I cannot test, but it should work. On android I had problem with browser different from Chrome in the past, but with Chrome I had no problem. Which service are you trying to use the yubi with?

@@codewrecks I think it's called webauthen. Not the TOTP or passkey. I still use a password and then use the key after entering the password. I know the key is properly added to my accounts because I have no problem with a laptop.

In android I had problems using browsers different from Chrome, but on iPhone official documentation states that it should just work support.apple.com/it-it/102637 . Which service are you using? Google, Microsoft, or it does not work with any service?