ddrinka/1 SSH TPM.md

## 1 SSH TPM.md

      
    Raw
  

              1 SSH TPM.md
            
          
    Create a TPM-protected SSH key

Windows

Ensure TPM is available

tpm.msc

Create a private key in the TPM

# I've elected to allow a simple 4-digit numeric pin. Access to the TPM hardware is sufficient multi-factor for me.
tpmvscmgr create /name "{KEY NAME}" /pin prompt /adminkey random /generate /pinpolicy minlen 4 uppercase allowed lowercase allowed specialchars allowed

Create a certificate

request.inf

[NewRequest]
Subject = "CN={RECOGNIZABLE SUBJECT NAME}"
Keylength = 2048
Exportable = FALSE
UserProtected = TRUE
MachineKeySet = FALSE
ProviderName = "Microsoft Base Smart Card Crypto Provider"
ProviderType = 1
RequestType = CERT
KeyUsage = 0x80

Create and load the certificate

certreq -new -f request.inf

Install Putty CAC

https://github.com/NoMoreFood/putty-cac/releases
Choose the certificate to authenticate with

putty.exe -> Connection -> SSH -> Certificate

See Image Below

Save as default configuration
Deploy the authorized_keys

Within putty certificate configuration screen, copy the SSH Key to the clipboard

Drop it into ~/.ssh/authorized_keys on machines
SSH Agent

Configure Pageant

Enable Autoload Certs and Cert Auth Prompting
Configure Agent Forwarding

putty.exe -> Connection -> SSH -> Auth -> Allow agent forwarding

Save as default configuration
Make Pageant Start On Login

C:\Program Files\PuTTY\pageant.exe -> Send to Desktop (create shortcut)

Start -> Run -> shell:startup

Move the shortcut to the Startup folder just opened

  
## 2 Putty CAC.png

      
    Raw
  

              2 Putty CAC.png
            
          
## SSH Yubikey.md

      
    Raw
  

              SSH Yubikey.md
            
          
    Create a Yubikey SSH key

Windows

Set a PIN / PUK

yubico-piv-tool.exe -a change-pin -P 123456
yubico-piv-tool.exe -a change-puk -P 12345678

Create the key

yubico-piv-tool.exe -a generate -s 9c -S "/CN=ddrinka-yubico/" --valid-days 3650 --touch-policy=always --pin-policy=once --pin-retries=8 --puk-retries=8 -o public.pem

Generate a self-signed certificate

yubico-piv-tool.exe -a verify -a selfsign -s 9c -S "/CN=ddrinka-yubico/" --valid-days 3650 -i public.pem -o cert.crt     #Touch the key to authorize
yubico-piv-tool.exe -a import-certificate -s 9c -i cert.crt

Verify certificate loaded on Yubikey

yubico-piv-tool.exe -a status

Load and verify certificate in Windows

certutil -scinfo   #After entering pin, touch the key to authorize

When Certificate List is displayed, click to view certificate, and install to "Personal".
Deploy the authorized_keys

Within putty certificate configuration screen, copy the SSH Key to the clipboard

Drop it into ~/.ssh/authorized_keys on machines
SSH Agent

Install Putty CAC

https://github.com/NoMoreFood/putty-cac/releases
Configure Pageant

Enable Autoload Certs and Cert Auth Prompting
Configure Agent Forwarding

putty.exe -> Connection -> SSH -> Auth -> Allow agent forwarding

Save as default configuration
Make Pageant Start On Login

C:\Program Files\PuTTY\pageant.exe -> Send to Desktop (create shortcut)

Start -> Run -> shell:startup

Move the shortcut to the Startup folder just opened