If you use Linux Mint you need to edit the lightdm file as Linux Mint doesn't use gdm-password. Just follow the same method for making the change and it will work the exact same way. I have been looking for a guide to Yubikeys for over a year. How did I miss this back in April? I love this channel! Subscribed.
Yes I agree, the video is good, but the music is tirring. The music should be quite a bit lower volume, and should pick music that is more suited to be backround music. That means they should not be in such a fast tempo, it gives a sense of urgency which is generally bad, but especially in such a long tutorial. And also some background music is composed in such a way the melody line is more "forgetful", so it doesn't take attention away from the tutorial.
Music is among the most subjective elements of a video. It's too fast. Too slow. Too loud. Too soft. Personally, I like this one except that I cannot listen at 1.25x speed without making it sound crazy. I can't remember ever watching a tutorial video that does not have bkg music and wishing it did. Tough calls for creators.
I agree as well. It's an excellent, well produced video with great content which is why it's really important for the content to be the hero. I found the music distracting throughout which diluted my enjoyment. Easy fix for next time though! 😊👍🏻
An additional application for these is PGP encrypted emails. You can load in your private key stubs and then when you send an encrypted email you just touch the key for the email to be encrypted and signed with your private key. The trick is finding other people who are first of all nerdy enough, and second of all wise enough, to use PGP. I only know one person - me - and so I can only send encrypted emails to myself. But it's a very agreeable secret conversation.
Very funny :-) Yes, I've often wondered how many 'encrypted' individuals any one person knows. Probably different for companies who value security, and anyone in Russia who disagrees with... well anything.
Heh, I set up PGP for email, too. And so far, the only thing it has been good for is to encrypt facebook messages sent to my email account--not that I even really use facebook anymore 😜
I have 4 individuals that I use PGP with, and one financial institution. What's frustrating is that once it is setup it is so easy to use, and best of all I can be confident that the author of the email actually sent it.
I've just subscribed & rang the notification bell. I've read all the replies up to this point. I, like most everyone else, wish there was no background music. I've successfully "Smart-Cart Enabled" both of my YubiKeys to both of my Macs. The only way I can log into either computer is with my YubiKey/PIN. Login passwords no longer work. It should be mentioned that High Sierra OS 10.13 is the oldest Mac OS that can be configured to use YubiKeys. Warm Regards from Reno, Nevada
Great video! I just would like to give my point of view as a user and also describe how I use my Yubikeys (not as you does). I use Yubikeys, but the implantation of FIDO2 is lacking mon many websites, and sometimes you can only register one key... I hope the situation will improve in the future. So, about the Yubikey 5 (the on that I use) OTP have a limit of 20 or 25, so if you have more them that you have to mange multiple Yubikey or really on tiger solutions. About the biometric Yubikey serie 5 potential user have to consider the longevity and reliability of the fingerprint reader, personally it's a concern for me maybe not for other people. About my usage, I love the opengpg support of the Serie 5, generating your master keys and sub keys with a expriation date, and burning the subkeys on your Yubikeys. The private subkeys are on your Yubikeys, and the private master key never touch a online computer and is store and backup in different and secure places. Private subkeys can't be extract (beside some exploit...) You can configure your key as you want, for example can set a pasword, requiring the user to touch physically your key, set the number of try before the Yubikey destroy you subkeys. Opengpg is very flexible, You can use this for a password manager, for encryp email, files, to log on you server using ssh ( SSH using opengpg is more convenient for me , the technique use in the video require openssh 8.2.. this version isn't yet on every LTS distro since it's quite recent. But FIDO2 is a more secure it's a fact) I like the fact that I use one public key for everything, that the key never leave my Yubikeys but that I have the master key and that I can switch of other device or tools in the future that supports opengpg. So my advice, chose your Yubikey accordingly to you need, and don't forget to setup you Yubikey, for sensitive use case setup your Yubikey in a airgape PC using a live distro like Tails who supports Yubikey out of the box. Keep in mind that if you don't manage your keys, someone else does it for you..
Just recieved the cheaper security key series ( blue one) and it does support NFC. I tested it with my phone. I also think it supports OTP. See the wifi symbol on the key.
Why the music? It is too loud and a big distraction. At times, the loud music was in the foreground and your instructions were in the background. I even tried skipping ahead to avoid the music, but the distracting music did not stop.
Great video. Informative and clear as always. I see plenty of feedback on the background music, but just one additional suggestion: Consider testing the background music at different playback speeds ahead of time. For those of us who listen on fast playback, some music/tempos develop strange artifacts and become extra distracting at faster playback speed, which might contribute to why some found the music more distracting.
Gday Jay, firstly I love your content👍🏻 You explain things simple and very easy to follow along. In regards to Yubikey, would you consider doing a tutorial install for Fedora? I have had no luck as the documentation is not easy to follow (for me anyway) or it’s not up to date. Thanks again for your work. 👍🏻
I've done a little more investigation and going to /etc/pam.d and changing common-auth seems to cover all the login methods at once. Changing the individual files gives finer grained control but for a change that should be ubiquitous common-auth is probably a better place. I don't do ssh so I didn't test that. If you do decide to change common-auth you will probably want to back out the changes to the specific files such as login, unless you like pressing the Yubikey more than once.
Probably best Yubikey overview I've found, and I've been reviewing quite a bit of different instructional material. So, thank you for this. Would be great if you can also create a Yubikey - Veracrypt instructional video as well.
Apparently the name has two sources: 1) "Your UBIquitous KEY" and 2) Japanese word "yubi" (指 'finger') to represent touching your YubiKey with your finger to verify your physical present.
Although it doesn't carry the certifications of the HSM, the YubiKey 5 series can also act as a HSM, storing private keys in a way that can't be retrieved (so the YubiKey itself signs certificates, for example). SmallStep use this capability to build a Raspberry Pi-based local certificate authority.
@@drescherjm If you set up a local certificate authority--whether using Smallstep, as I have, or some other software--you'll still need to trust that CA cert on any client machines that would be relying on it. But that should be a one-time process; once you trust the CA cert, you'll trust any certs it issues.
I just found about yubikeys through Tom's video... Did not give this a thought before since using an app to do the 2FA.. Going to order one and a backup one asap.. Seems invaluable these days! Thansk alot of this great video, very well explained!
This was a great video for setting up the Yubikey, however, what is the process to add your backup key(s) to each system?? Do they not have to be somehow sync'd to each computer individually as well? Secondly, I have major hearing issues and I would appreciate it if you discontinued ANY background music in videos, your videos are great learning tools and the music makes it almost impossible for me to actually make out what you are saying. Thank you
Keys are independent. You use a second key in the sense that whatever you set up for the first key (TOTP/OTP/etc. for your website/service logins.), you also do with a 2nd key in tandem, so that both keys are registered with the site/service/password app/etc.
@@LearnLinuxTV I noticed there were two uploads yesterday and this video was one of them minus the music. I even left a comment thanking you for this great resource.
For some future person having problems setting this up for a Debian device (Raspi 4 in my case): if you can't login after setting this up this will likely be due to a PAM Module error (at leas this was for me, you can check by ooening a second terminal and trying to ssh in. After that check the debug by typing in "sudo journal -u ssh -e). If thats the case edit the /etc/pam.d/sshd file and delete the key=.... part and replace it with "debug". This is the right way according to the recent documentations.
Mr. Jay, This is just an idea for a future video. I would like to see someone deep-dive into the new LXQt 1.1 vs LXDE. What would be the reasons to continue to use LXDE ? Where does each excel in 2022 ? What are some of the major problems with either ? Is there any reason to use either on a new computer ? What would be the difference between using LXQt, and just configuring a KDE Plasma session to use less resources ? What are you giving up in LXQt vs. KDE ?
Thank you for the in-depth video. Unfortunately, I have yet to start setting mine up because the directions do not match what I see on my end. I purchased two 5ci that are useless to me because I can't find directions that match my laptop setup, and the downloads do not do anything on my phone. I am running all up-to-date current software on both relatively new devices. I wish I could just pay someone to help me. Better than being out $150 for nothing. 😭😡
Hi Jay, great video! Does openSSH with Fido2 work with nested ssh sessions? For instance, I usually ssh from my windows machine into my Pop-OS VM, and from there I can run tmux and SSH into my other linux servers.
Hello Jay. Many thanks for a great video on setting up YubiKey. Just noticed at 39:17 where you create the SSH keypair you have a typo in your command. The keys where created however, the date subshell included a ')' in the name. Command should be: ssh-keygen -t ed25519-sk -C "$(hostname)-$(date +'%d-%m-%Y')-yubikey1"
How can you add RFID/NFC to a PC that doesn't have it? I am just about to add Yubikey to my systems and I have a NFC Yubikey for use with my Android phone and would like to use use NFC on my desktop as well. I also agree with others about the background music and it's default volume. Also are the step for installing Yubikey on MS Windows the same for both Win10 & Win11?
Very good tutorial !!! One question: where is the link to the blog post with the commands? I went to link you wrote on description but the blog post contains only the video .
I bought mine today, got it home and... nothing. No lights come on when I plug it in and I have tried on multiple devices. Checked every setting. Looks like mine was faulty. I've already spoke to the store and I'm good for an exchange. Hopefully, the next one works fine.
Thanks Jay, this video is a big help! Just wondering... Do we need to setup PIN, PUK and Management Key for each additional Yubikey we want to use as backup? Thx 🙂
Question - In your opinion, what's the privacy implications of this? Because surely if the key has its own unique ID & is registered across all these platforms, you're basically (through the use of this key across all of your accounts) constructing your own digital identity for big tech... banking apps, online shopping, social media - the lot. This key being the concrete proof. Perhaps why all these corporate giants (especially Google) partnered up?? Are they sharing data about this stuff?? Correct me if I'm wrong, but I'm skeptical... sounds like data harvesting/ method of knitting your accounts together, that's being marketed as 'security'. Similar to what they did with cars - keyless entry was marketed as a 'safety feature'... until it was abused by criminals. Thoughts?
We need a 3 factor authentication! Why isn’t nobody making this, maybe they have and I don’t know. It’ll be nice to put your password in, then the security code, and then a different security code. That’ll be sweet.
This video is only 9 months old but your Yubikey Windows GUI isn't at all like mine that I just downloaded and installed from Yubikey. I guess they revamped the GUI since you posted this.
Watching this, I am extremely leery of installing a Yubikey login. It has been my experience that Murphy was an optimist. If that happens while setting up the machine, one is in deep trouble. Also, the music in the background is very distracting.
Is there any risk on windows or mac of the program being deleted would it affect logging in? Or does it revert to old standard password. 1 thing you can do in mac is in settings make it so you have to allow USB devices. So a prompt comes up before it can be used.
Ok Thanks Jay i will subscribe now ... hold on .... ey voila. I use Linux Mnit Desktop Dell 390. I have a love hate relation with the cli. I did install the Yubi authenticator via the app image and the manager. Then i started copying your commands and this went ok untill i hit the command: sudo nano /etc/pam.d/gdm-password. This file is empty on my system and in Jays example it is not, here it stops for me. When i want to use a sudo command i do have to touch the key. So i did something good, but after a reboot the desktop just boots up and starts and logs in without me asking anything. I need to find out why my gdm password file is empty. And to be fair it is a lot of work just getting the key on all my devices, phones, tablets, windows pc, linux laptop and pc, the power macs, the G5 ' s ..... For al the weiners about the music ..... if you can do any better then jay then bring it on. It is so easy to cry and point, ppl should realise that making any kind of tutorial written or filmed is really hard to do.
Would I be about to use a Security Key C NFC The YubiKey 5 C NFC to create passkeys for my APPs and Websites? Or do I need to get The YubiKey 5 C NFC. What would be the reason way I would want to get The YubiKey 5 C NFC over the Security Key C NFC
Great video, plan to play with my metal install of Ubuntu soon. Is there a way to make a Yubikey work on a Proxmox Ubuntu VM? I can't seem to figure out how ro forward the port USB w Yubikey to VM....
Nice work, Jay. What happens on a Windows desktop if you use a Microsoft account to log in to it? Also, I administer linux servers using Putty for my ssh connection. Can Yubikey help in that use case?
how can a product profess to do away with passwords when it is inly supported by a handfull of platforms, most of which Inhave never used and never heard of
Is there a risk to carrying a yubikey with you along with your phone? Eg could it allow access to the phone? That worries me when I see videos on TH-cam such as Payette Forward
This doesnt seem to work on Debian Bookworm. I've tried several times and when going to test after modifying the Nano file, nothing happens with the key.. no flash... nothing. Doesn't accept the sudo password either. Base Debian Bookworm and Kali based on the same... same problem. I had it working in the past on previous versions of Debian but no dice so far on this one.
For the implementation of FIDO2 for OpenSSH, how is it possible to use two different Yubikeys? If one yubikey is lost, there would be a backup for login.
I'm pretty new to Linux but have 25+ years of Win support, I was able to complete this and it worked great when logging out and testing but then I restarted the laptop and I couldn't log back in, it kept saying password was incorrect. Had to restore from snapshot from yesterday. Any ideas what could have happened, running Mint 21.3 cinnamon and had recently updated the kernel to 5.15.0-102.112. all is good after the restore but I wanted this to work and I'd love to understand how to get it to stay working. I also had to use the fix from the comment that says to edit the lightdm file as Linux Mint doesn't use gdm-password and that worked.. thanks
what exactly is the change management key? I mean if I have 2 yubikey can I copy the management key of the first yubikey to my 2nd? if so .. what will happen? for what purpose is the management key exactly? is this the key to somehow clone the other one?
11:48 Doesn't this mean that if the device is plugged in to your PC anyone can login (because it does not have biometrics) or do you still have the password entry?? Edit: 21:37 I see now you have a pin to remember instead of a password.
What if in the descriptions it says it can act as FIDO ASM may access authentication devices, create & delete FIDO registrations on behalf of other apps?! Is this good or bad???
I wonder if this works on a linux laptop when you have disk-encryption. Would it work than, get you to the encryption passhrase and from there login with the key? As prior to that it wouldn't be able to read the /home. Wonder if it interferes though or just works as well. For online accounts it's recommended to have at least 2 keys. How to deal with that when you use it for login? Nice video though!
Hi Jay: Question for you. I followed your instructions to set up Yubikey with local macOS user account. It works to unlock using the Yubikey code when the key is plugged in the USB C as you demonstrated. However when the key is not plugged in, it does not prompt me to insert the Yubikey to complete the log in process. It's just using my Macbook log in. Am I supposed to disable my Macbook log in? Kindly advise...
Great video as usual...but I couldn't follow it. The music back round was at the same volume as vocal content, making it totally unintelligeable. Why? As we get older we lose the ability to discriminate one sound from another. We can't pick out content from the mood music. Young kids (under 50) can, but not all your followers. Keep up the great videos (if I can understand)
![ลองสั่งของจากแอพ temu ถูกจริงหรอ?? ( part : 1/2 ) [โกงไหมครับ ep.89 ] | DOM](http://i.ytimg.com/vi/RTcZSQTiDZw/mqdefault.jpg)
If you use Linux Mint you need to edit the lightdm file as Linux Mint doesn't use gdm-password. Just follow the same method for making the change and it will work the exact same way. I have been looking for a guide to Yubikeys for over a year. How did I miss this back in April? I love this channel! Subscribed.
I think you saved me. No way this was getting done without your video. Much appreciated!
Great video on the yubikey, thanks for making it. I could do without the background music though, it's too loud.
I also found the music wearisome and annoying.
Agreed on both counts. Excellent video (as far as I watched). I gave up trying to watch as the music was too intrusive.
Yes I agree, the video is good, but the music is tirring. The music should be quite a bit lower volume, and should pick music that is more suited to be backround music. That means they should not be in such a fast tempo, it gives a sense of urgency which is generally bad, but especially in such a long tutorial. And also some background music is composed in such a way the melody line is more "forgetful", so it doesn't take attention away from the tutorial.
Music is among the most subjective elements of a video. It's too fast. Too slow. Too loud. Too soft.
Personally, I like this one except that I cannot listen at 1.25x speed without making it sound crazy.
I can't remember ever watching a tutorial video that does not have bkg music and wishing it did.
Tough calls for creators.
I agree as well. It's an excellent, well produced video with great content which is why it's really important for the content to be the hero.
I found the music distracting throughout which diluted my enjoyment.
Easy fix for next time though! 😊👍🏻
Thanks for going to all the trouble of making such a thorough Yubikey primer. You ROCK my friend!!
The background music volume changing is kinda jarring. I think it would be better if lower volume and consistent.
Even better would be NO music.
Yes, it’s loud.
An additional application for these is PGP encrypted emails. You can load in your private key stubs and then when you send an encrypted email you just touch the key for the email to be encrypted and signed with your private key.
The trick is finding other people who are first of all nerdy enough, and second of all wise enough, to use PGP. I only know one person - me - and so I can only send encrypted emails to myself. But it's a very agreeable secret conversation.
Very funny :-) Yes, I've often wondered how many 'encrypted' individuals any one person knows. Probably different for companies who value security, and anyone in Russia who disagrees with... well anything.
Heh, I set up PGP for email, too. And so far, the only thing it has been good for is to encrypt facebook messages sent to my email account--not that I even really use facebook anymore 😜
I have 4 individuals that I use PGP with, and one financial institution. What's frustrating is that once it is setup it is so easy to use, and best of all I can be confident that the author of the email actually sent it.
I'm starting now! Glorious future.
I've just subscribed & rang the notification bell.
I've read all the replies up to this point.
I, like most everyone else, wish there was no background music.
I've successfully "Smart-Cart Enabled" both of my YubiKeys to both of my Macs. The only way I can log into either computer is with my YubiKey/PIN. Login passwords no longer work.
It should be mentioned that High Sierra OS 10.13 is the oldest Mac OS that can be configured to use YubiKeys.
Warm Regards from Reno, Nevada
Great video! I just would like to give my point of view as a user and also describe how I use my Yubikeys (not as you does).
I use Yubikeys, but the implantation of FIDO2 is lacking mon many websites, and sometimes you can only register one key... I hope the situation will improve in the future.
So, about the Yubikey 5 (the on that I use) OTP have a limit of 20 or 25, so if you have more them that you have to mange multiple Yubikey or really on tiger solutions. About the biometric Yubikey serie 5 potential user have to consider the longevity and reliability of the fingerprint reader, personally it's a concern for me maybe not for other people.
About my usage, I love the opengpg support of the Serie 5, generating your master keys and sub keys with a expriation date, and burning the subkeys on your Yubikeys.
The private subkeys are on your Yubikeys, and the private master key never touch a online computer and is store and backup in different and secure places.
Private subkeys can't be extract (beside some exploit...) You can configure your key as you want, for example can set a pasword, requiring the user to touch physically your key, set the number of try before the Yubikey destroy you subkeys.
Opengpg is very flexible, You can use this for a password manager, for encryp email, files, to log on you server using ssh ( SSH using opengpg is more convenient for me , the technique use in the video require openssh 8.2.. this version isn't yet on every LTS distro since it's quite recent. But FIDO2 is a more secure it's a fact)
I like the fact that I use one public key for everything, that the key never leave my Yubikeys but that I have the master key and that I can switch of other device or tools in the future that supports opengpg.
So my advice, chose your Yubikey accordingly to you need, and don't forget to setup you Yubikey, for sensitive use case setup your Yubikey in a airgape PC using a live distro like Tails who supports Yubikey out of the box.
Keep in mind that if you don't manage your keys, someone else does it for you..
Just recieved the cheaper security key series ( blue one) and it does support NFC. I tested it with my phone. I also think it supports OTP. See the wifi symbol on the key.
Why the music? It is too loud and a big distraction. At times, the loud music was in the foreground and your instructions were in the background. I even tried skipping ahead to avoid the music, but the distracting music did not stop.
Yep, I gave up after 8 minutes. No idea why youtubers invariably feel the need to add loud, repetitive background noise.
Thank you for making the Mac login with Yubikey so easy to follow.
The Best intro and workarounds about Yubikey!
Thanks for the video. What was missing is a backup strategy.
Great video. Informative and clear as always. I see plenty of feedback on the background music, but just one additional suggestion:
Consider testing the background music at different playback speeds ahead of time. For those of us who listen on fast playback, some music/tempos develop strange artifacts and become extra distracting at faster playback speed, which might contribute to why some found the music more distracting.
I finally broke down and bought one. Re-watching this to see what I need to do to get this working. Of course this is the first place I go. 😀
Gday Jay, firstly I love your content👍🏻 You explain things simple and very easy to follow along. In regards to Yubikey, would you consider doing a tutorial install for Fedora? I have had no luck as the documentation is not easy to follow (for me anyway) or it’s not up to date. Thanks again for your work. 👍🏻
I've done a little more investigation and going to /etc/pam.d and changing common-auth seems to cover all the login methods at once. Changing the individual files gives finer grained control but for a change that should be ubiquitous common-auth is probably a better place. I don't do ssh so I didn't test that.
If you do decide to change common-auth you will probably want to back out the changes to the specific files such as login, unless you like pressing the Yubikey more than once.
Great video but the music in the background is too distracting
It distracts and also steps all over the narration.
Probably best Yubikey overview I've found, and I've been reviewing quite a bit of different instructional material. So, thank you for this.
Would be great if you can also create a Yubikey - Veracrypt instructional video as well.
Apparently the name has two sources: 1) "Your UBIquitous KEY" and 2) Japanese word "yubi" (指 'finger') to represent touching your YubiKey with your finger to verify your physical present.
Although it doesn't carry the certifications of the HSM, the YubiKey 5 series can also act as a HSM, storing private keys in a way that can't be retrieved (so the YubiKey itself signs certificates, for example). SmallStep use this capability to build a Raspberry Pi-based local certificate authority.
Are the certificates made in this way still viewed by browsers ... as untrusted? This is something that annoys me with self-signed certificates.
@@drescherjm If you set up a local certificate authority--whether using Smallstep, as I have, or some other software--you'll still need to trust that CA cert on any client machines that would be relying on it. But that should be a one-time process; once you trust the CA cert, you'll trust any certs it issues.
I just found about yubikeys through Tom's video... Did not give this a thought before since using an app to do the 2FA.. Going to order one and a backup one asap.. Seems invaluable these days! Thansk alot of this great video, very well explained!
This was a great video for setting up the Yubikey, however, what is the process to add your backup key(s) to each system?? Do they not have to be somehow sync'd to each computer individually as well? Secondly, I have major hearing issues and I would appreciate it if you discontinued ANY background music in videos, your videos are great learning tools and the music makes it almost impossible for me to actually make out what you are saying. Thank you
I 2nd the motion
Keys are independent. You use a second key in the sense that whatever you set up for the first key (TOTP/OTP/etc. for your website/service logins.), you also do with a 2nd key in tandem, so that both keys are registered with the site/service/password app/etc.
Great video. No complaints here.
Wait, isn't it yesterdays video?
Yesterday's video was an episode of the Enterprise Linux Security podcast.
@@LearnLinuxTV I noticed there were two uploads yesterday and this video was one of them minus the music. I even left a comment thanking you for this great resource.
I noticed this too. Now the video from yesterday is gone. So it looks like a reupload.
i was hoping for a new version, with multiple keys :P
For some future person having problems setting this up for a Debian device (Raspi 4 in my case): if you can't login after setting this up this will likely be due to a PAM Module error (at leas this was for me, you can check by ooening a second terminal and trying to ssh in. After that check the debug by typing in "sudo journal -u ssh -e). If thats the case edit the /etc/pam.d/sshd file and delete the key=.... part and replace it with "debug". This is the right way according to the recent documentations.
Dunno why but I got the automatic pairing message. Btw thank you for a video - so good and so informative.
Great session!!! Thanks found value
Great video but the music is WAY TO LOUD!
Just bought one the other day. Great video. Thanks! 👍❤️
Superb guide!
Have you ever listened to your videos before airing them, DH. Maybe you should try that once!
It is weird Jay added background music in this one. His other videos do not have it.
I'd like to hear / see more elaborations on the various aspects of the yubico, like what are those slots that you where mentioning @27:26?
Mr. Jay, This is just an idea for a future video. I would like to see someone deep-dive into the new LXQt 1.1 vs LXDE. What would be the reasons to continue to use LXDE ? Where does each excel in 2022 ? What are some of the major problems with either ? Is there any reason to use either on a new computer ?
What would be the difference between using LXQt, and just configuring a KDE Plasma session to use less
resources ?
What are you giving up in LXQt vs. KDE ?
Thank you for the in-depth video. Unfortunately, I have yet to start setting mine up because the directions do not match what I see on my end. I purchased two 5ci that are useless to me because I can't find directions that match my laptop setup, and the downloads do not do anything on my phone. I am running all up-to-date current software on both relatively new devices. I wish I could just pay someone to help me. Better than being out $150 for nothing.
😭😡
Good job, but additional questions: how to use Yubikey Bio for Linux login & how to save more than one key on a linux machine
A really good informative video but the music choice is distracting, too loud and not sure why its there.
Hi Jay, great video! Does openSSH with Fido2 work with nested ssh sessions? For instance, I usually ssh from my windows machine into my Pop-OS VM, and from there I can run tmux and SSH into my other linux servers.
Hello Jay. Many thanks for a great video on setting up YubiKey. Just noticed at 39:17 where you create the SSH keypair you have a typo in your command. The keys where created however, the date subshell included a ')' in the name. Command should be: ssh-keygen -t ed25519-sk -C "$(hostname)-$(date +'%d-%m-%Y')-yubikey1"
YubiKey scares the ___ out of me. I'm afraid to install something that could lock me out of my own computer! Is there a safe way to uninstall it?
How can you add RFID/NFC to a PC that doesn't have it?
I am just about to add Yubikey to my systems and I have a NFC Yubikey for use with my Android phone and would like to use use NFC on my desktop as well.
I also agree with others about the background music and it's default volume.
Also are the step for installing Yubikey on MS Windows the same for both Win10 & Win11?
Very good tutorial !!!
One question: where is the link to the blog post with the commands? I went to link you wrote on description but the blog post contains only the video .
Thanks for the video, will those commands work on redhat or CentOS? If not can you include the required commands?
Thanks for the Yubi-Key walk through. Is that a System 76 w/ Threadripper in the background?
I bought mine today, got it home and... nothing. No lights come on when I plug it in and I have tried on multiple devices. Checked every setting. Looks like mine was faulty. I've already spoke to the store and I'm good for an exchange. Hopefully, the next one works fine.
Great content, BUT: The background music (READ: NOICE) is really disturbing, at least to me.
Great video. However, many of the Security Key series have NFC capability. This is clear on the Amazon listing.
Thanks Jay, this video is a big help! Just wondering... Do we need to setup PIN, PUK and Management Key for each additional Yubikey we want to use as backup? Thx 🙂
When logging in to your OS, why do you have to supply a password when using Yubikey? I thought Yubikey eliminated passwords? Thanks!!
you will have to supply a pin to unlock the yubikey
Question - In your opinion, what's the privacy implications of this? Because surely if the key has its own unique ID & is registered across all these platforms, you're basically (through the use of this key across all of your accounts) constructing your own digital identity for big tech... banking apps, online shopping, social media - the lot. This key being the concrete proof.
Perhaps why all these corporate giants (especially Google) partnered up?? Are they sharing data about this stuff??
Correct me if I'm wrong, but I'm skeptical... sounds like data harvesting/ method of knitting your accounts together, that's being marketed as 'security'. Similar to what they did with cars - keyless entry was marketed as a 'safety feature'... until it was abused by criminals.
Thoughts?
We need a 3 factor authentication!
Why isn’t nobody making this, maybe they have and I don’t know.
It’ll be nice to put your password in, then the security code, and then a different security code. That’ll be sweet.
Overkill and will cause loads of account lockouts
very useful on everything
To find your username in windows run cmd (Winkey = r)(type cmd in the run box) and type whoami in the cmd window
The background music is REALLY distracting and annoying. Please get rid of it. It ruins your videos.
Why I have never seen anyone use it on desktop PC?????
and btw does it work for that
This video is only 9 months old but your Yubikey Windows GUI isn't at all like mine that I just downloaded and installed from Yubikey. I guess they revamped the GUI since you posted this.
Watching this, I am extremely leery of installing a Yubikey login. It has been my experience that Murphy was an optimist. If that happens while setting up the machine, one is in deep trouble. Also, the music in the background is very distracting.
Is there any risk on windows or mac of the program being deleted would it affect logging in? Or does it revert to old standard password.
1 thing you can do in mac is in settings make it so you have to allow USB devices. So a prompt comes up before it can be used.
Regarding the last segment for SSH: How do I add a second Yubikey?
Ok Thanks Jay i will subscribe now ... hold on .... ey voila. I use Linux Mnit Desktop Dell 390. I have a love hate relation with the cli. I did install the Yubi authenticator via the app image and the manager. Then i started copying your commands and this went ok untill i hit the command: sudo nano /etc/pam.d/gdm-password.
This file is empty on my system and in Jays example it is not, here it stops for me. When i want to use a sudo command i do have to touch the key. So i did something good, but after a reboot the desktop just boots up and starts and logs in without me asking anything. I need to find out why my gdm password file is empty.
And to be fair it is a lot of work just getting the key on all my devices, phones, tablets, windows pc, linux laptop and pc, the power macs, the G5 ' s .....
For al the weiners about the music ..... if you can do any better then jay then bring it on. It is so easy to cry and point, ppl should realise that making any kind of tutorial written or filmed is really hard to do.
Would I be about to use a Security Key C NFC The YubiKey 5 C NFC to create passkeys for my APPs and Websites? Or do I need to get The YubiKey 5 C NFC. What would be the reason way I would want to get The YubiKey 5 C NFC over the Security Key C NFC
Is the process for setting up a Yubikey and a backup Yubikey at the same time different?
Great video, plan to play with my metal install of Ubuntu soon. Is there a way to make a Yubikey work on a Proxmox Ubuntu VM? I can't seem to figure out how ro forward the port USB w Yubikey to VM....
excuse me please but how come in your set up you only set up a piv pin what about the fido2 pin thanks
What's the Best yubikey 5 NFC or yubikey NFC?
Nice work, Jay. What happens on a Windows desktop if you use a Microsoft account to log in to it? Also, I administer linux servers using Putty for my ssh connection. Can Yubikey help in that use case?
Is there a version of this video without the background music?
Can you use the key with multiple devices?
how can a product profess to do away with passwords when it is inly supported by a handfull of platforms, most of which Inhave never used and never heard of
Is there a risk to carrying a yubikey with you along with your phone? Eg could it allow access to the phone? That worries me when I see videos on TH-cam such as Payette Forward
Thanks for the great instructions!
Should have shown at least once the light blinking and pressing the button and what model you were using
This doesnt seem to work on Debian Bookworm. I've tried several times and when going to test after modifying the Nano file, nothing happens with the key.. no flash... nothing. Doesn't accept the sudo password either. Base Debian Bookworm and Kali based on the same... same problem. I had it working in the past on previous versions of Debian but no dice so far on this one.
For the implementation of FIDO2 for OpenSSH, how is it possible to use two different Yubikeys?
If one yubikey is lost, there would be a backup for login.
I'm pretty new to Linux but have 25+ years of Win support, I was able to complete this and it worked great when logging out and testing but then I restarted the laptop and I couldn't log back in, it kept saying password was incorrect. Had to restore from snapshot from yesterday. Any ideas what could have happened, running Mint 21.3 cinnamon and had recently updated the kernel to 5.15.0-102.112. all is good after the restore but I wanted this to work and I'd love to understand how to get it to stay working. I also had to use the fix from the comment that says to edit the lightdm file as Linux Mint doesn't use gdm-password and that worked.. thanks
Wonderful video, thank you!
I have two keys. Is it a bad idea to use the same PINs for both keys, say when setting up PIV? My thinking is these should be clones, correct?
Hi Jay
please can you do a video how to setup pam_passwdqc from source code on Debian?
Thank you🎉🎉
2:48 after very long intro... What is a Yubikey?
what exactly is the change management key?
I mean if I have 2 yubikey can I copy the management key of the first yubikey to my 2nd? if so .. what will happen?
for what purpose is the management key exactly? is this the key to somehow clone the other one?
I'm a novice at this. Is there any key or device that enables complete lockdown of a PC -- not just a lockdown of user accounts?
11:48 Doesn't this mean that if the device is plugged in to your PC anyone can login (because it does not have biometrics) or do you still have the password entry?? Edit: 21:37 I see now you have a pin to remember instead of a password.
There is also Yubico Security Key NFC, so you don't have to go to the more expensive series.
You do because some of theses methods aren't using fido2, with windows it's using piv.
For the setting of the yubikey pin, What if all we have is an iphone, No desktop ?
Thank you, very educational.
Glad you enjoyed it!
What if in the descriptions it says it can act as FIDO ASM may access authentication devices, create & delete FIDO registrations on behalf of other apps?! Is this good or bad???
Nice nice! Does YubiKey work with Metamask, can we secure it with it!?
If someone forgets the yobico device then what step can we take ???? Plz answer
I wonder if this works on a linux laptop when you have disk-encryption. Would it work than, get you to the encryption passhrase and from there login with the key? As prior to that it wouldn't be able to read the /home. Wonder if it interferes though or just works as well. For online accounts it's recommended to have at least 2 keys. How to deal with that when you use it for login? Nice video though!
Are you able to use your local Yubikey to do sudo on the remote server?
Hi Jay: Question for you. I followed your instructions to set up Yubikey with local macOS user account. It works to unlock using the Yubikey code when the key is plugged in the USB C as you demonstrated. However when the key is not plugged in, it does not prompt me to insert the Yubikey to complete the log in process. It's just using my Macbook log in. Am I supposed to disable my Macbook log in? Kindly advise...
Thanks for the content
Thanks!
Great video as usual...but I couldn't follow it. The music back round was at the same volume as vocal content, making it totally unintelligeable. Why? As we get older we lose the ability to discriminate one sound from another. We can't pick out content from the mood music. Young kids (under 50) can, but not all your followers. Keep up the great videos (if I can understand)
Does YubiKeys work with ARM PC's?
What key works with Microsoft Windows11this type of key YubiKey is hard to setup on windows11
Can u please remove the background disturbing n distracting music .
Love your content 🙂
it doesn't block all sudo commands and you can still use gui apps like synaptic