Setting up Yubikey with SSH and Git on Windows 10 + Powershell

yubikey-windows10.md

Setting up Yubikey with SSH and Git on Windows 10 + Powershell

Based on the following guides:

• https://worklifenotes.com/2019/07/05/yubikey-for-ssh-on-windows-complete-walkthrough/
• https://scatteredcode.net/signing-git-commits-using-yubikey-on-windows/
• https://bhavik.io/2019/02/02/yubikey-git-ssh.html

Install dependencies

• Install Gpg4win
• Install PuTTY

Set up new PINs for yubikey

• Open Powershell
• Set up new PINs:
  • Tip: the PINs doesn't have to be numeric-only

  gpg --expert --edit-card
  > admin
  > factory-reset # optional step
  > passwd
  # choose 1 to change PIN
  # default PIN is 123456
  # choose 3 to change Admin PIN
  # default PIN is 12345678
  > q
  > forcesig
  > quit
  

• Add identification data

  gpg --expert --edit-card
  > admin
  > name
  # type your last names
  # and then your first names
  > lang
  # type your preference language (e.g., en)
  

• Check keys: gpg --expert --card-status

Create a GPG key using Kleopatra

• Go to Tools > Manage smartcard
• Click on Generate new keys (I recommend creating a RSA 4096 key)

Configure Kleopatra to allow SSH support

• In Kleopatra, click on Settings > Configure Kleopara
• Select GnuPG System
• Go to the tab Private Keys
• Check Enable ssh support and Enable putty support
• Click on Apply settings

Configure Git to use yubikey

• Run this command to add Github to the list of known hosts and avoid a freezing issue using git: plink -agent -v git@github.com
  • If this command fails with an FATAL ERROR: No supported authentication methods available (server sent: publickey) error, try restarting the GPG Agent
• Verify that the key is set up correctly: gpg --list-secret-keys --keyid-format LONG
  • Look for something like sec > rsa4096/683AB68D867FEB5C.
  • The key is the string after rsa4060/
• Point Git to globally use GnuPG:

  git config --global gpg.program "c:\Program Files\GnuPG\bin\gpg.exe"
  git config --global commit.gpgsign true
  git config --global user.signingkey KEY_FROM_THE_PREVIOUS_STEP
  git config --global core.sshcommand "plink -agent"
  

• If you haven't set up your Git user data, do it now:

  git config --global user.email your_email@email.com
  git config --global user.name "Your Full Name Here"
  

• Generate a public SSH key: gpg --export-ssh-key your_email@email.com > id_rsa.pub
• Add the public key into your Github account

Add your GPG Public Key to Github

• Open Kleopatra, double-click on your click, click Export...
  • Make sure you are exporting the public key. It should start with "-----BEGING PBP PUBLIC KEY BLOCK-----"
• Copy the key
• Go into Github
• Click on your profile image
• Click on Settings
• On the sidebar, click on SSH and GPG Keys
• Click on New GPG Key
• Paste the key

Accessing servers via SSH

• Instead of using the ssh command on Powershell, you have to use the plink command: plink username@server

Exporting your certificates

• On Kleopatra main screen, select your certificates
• Go to File > Export...
• Select a place to store your OpenPGP certificates

Importing your certificates

• On Kleopatra main screen, go to File > Import...
• Select your OpenPGP certificates files

To set a certificate trust level

• On Powershell, list the existing keys: gpg --list-secret-keys --keyid-format LONG
  • If no key show up, try restarting the GPG Agent
• To edit a key: gpg --edit-key KEYID
• To set trust level to ultimate:

trust
5 # to trust completely (ultimate)
y # to confirm your decision
save

Restarting GPG agent

• If you have issues connecting to your smartkey, try restarting the GPG Agent:

gpg-connect-agent killagent /bye
gpg-connect-agent /bye

That's it

Now you're all set. When using git or ssh, it should get the private key from your Yubikey and ask for its PIN number.

Enjoy :)