{"id":25948801,"url":"https://github.com/janthmueller/yubikey-resident","last_synced_at":"2026-05-09T01:39:35.518Z","repository":{"id":280281904,"uuid":"941333629","full_name":"janthmueller/yubikey-resident","owner":"janthmueller","description":"A Docker-based tool for generating and managing resident SSH keys on a YubiKey. 🚀","archived":false,"fork":false,"pushed_at":"2025-04-01T19:07:05.000Z","size":9,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-01T20:24:10.221Z","etag":null,"topics":["docker","fido2","hardware-key","passwordless-login","resident-keys","security","ssh","ssh-authentication","ssh-keygen","yubikey"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/janthmueller.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-03-02T03:19:18.000Z","updated_at":"2025-04-01T19:07:08.000Z","dependencies_parsed_at":"2025-03-02T14:31:33.861Z","dependency_job_id":null,"html_url":"https://github.com/janthmueller/yubikey-resident","commit_stats":null,"previous_names":["janthmueller/yubikey-resident"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/janthmueller/yubikey-resident","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/janthmueller%2Fyubikey-resident","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/janthmueller%2Fyubikey-resident/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/janthmueller%2Fyubikey-resident/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/janthmueller%2Fyubikey-resident/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/janthmueller","download_url":"https://codeload.github.com/janthmueller/yubikey-resident/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/janthmueller%2Fyubikey-resident/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32804489,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-08T08:22:46.396Z","status":"ssl_error","status_checked_at":"2026-05-08T08:22:45.650Z","response_time":54,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","fido2","hardware-key","passwordless-login","resident-keys","security","ssh","ssh-authentication","ssh-keygen","yubikey"],"created_at":"2025-03-04T11:22:47.432Z","updated_at":"2026-05-09T01:39:35.513Z","avatar_url":"https://github.com/janthmueller.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# YubiKey Resident SSH Key Generator\n\nThis repository provides a **Docker-based tool** for generating **resident SSH keys** using a **YubiKey**. Resident keys allow secure SSH authentication without needing to store the private key on disk.\n\n## What is a Resident SSH Key?\n\nA **resident SSH key** is a key pair stored directly on a **FIDO2-compatible YubiKey**. Unlike traditional SSH keys, the **private key never leaves the YubiKey**, and only a reference to the key is needed on the host machine. This makes it more secure and convenient, especially when switching devices, as you can restore the key reference at any time.\n\n## Features\n\n- Generates **resident SSH keys** that are stored directly on the YubiKey.\n- **Automatic key regeneration** (restore keys anytime using `ssh-keygen -K`).\n- Uses **Docker** to provide an isolated and repeatable environment.\n- Supports **optional UID tagging** for managing multiple resident keys.\n\n## Prerequisites\n\n- A **YubiKey 5 Series** or compatible **FIDO2 security key**.\n- **Docker** and **Docker Compose** installed on your system.\n- OpenSSH 8.2+ (for FIDO2 SSH key support).\n\n## Setup\n\nClone this repository and navigate into the project directory:\n\n```sh\ngit clone https://github.com/your-username/yubikey-resident.git\ncd yubikey-resident\n```\n\n## Usage\n\nTo generate a **new resident SSH key**, run:\n\n```sh\ndocker compose run --rm keygen\n```\n\nThis will:\n\n1. Prompt for an **optional key comment**.\n2. Display **existing resident keys** stored on the YubiKey.\n3. Prompt for an **optional UID** (to manage multiple keys).\n4. Generate a **new SSH key** stored directly on your YubiKey.\n5. Optionally drop you into a **bash shell** for further management.\n\n### How Reference Files Are Stored\n\nWhen generating a new resident SSH key, the reference files are automatically saved into the **`ssh_keys/`** folder (mapped to `/root/.ssh` in the container). These files include:\n\n- **`id_ed25519_sk`** – A reference file pointing to the private key stored on the YubiKey. If a UID was provided, the filename will be formatted as `id_ed25519_sk_\u003cUID\u003e`.\n- **`id_ed25519_sk.pub`** – The public key file used for SSH authentication.\n\nSince the actual **private key never leaves the YubiKey**, these reference files are simply used to interact with the key stored on the device. If deleted, they can always be regenerated using:\n\n```sh\nssh-keygen -K\n```\n\n### Restoring SSH Keys\n\nIf you lose the reference files (`id_ed25519_sk` and `id_ed25519_sk.pub`), you can **restore them** using:\n\n```sh\nssh-keygen -K\n```\n\nThis will retrieve all resident keys from your YubiKey.\n\n### Listing Stored Keys\n\nTo check what resident keys are stored on your YubiKey, run:\n\n```sh\nykman fido credentials list\n```\n\nThis will show all stored keys, including any **UIDs** you assigned during key generation.\n\n### Using SSH with Your YubiKey\n\nOnce the key is generated and restored, you can use it for SSH authentication:\n\n```sh\nssh -i ~/.ssh/id_ed25519_sk user@server.com\n```\n\nIf a UID was used, the correct filename should be specified, e.g.:\n```sh\nssh -i ~/.ssh/id_ed25519_sk_\u003cUID\u003e user@server.com\n```\n\n## Security Considerations\n\n✅ **Private keys never leave the YubiKey** (unlike standard SSH keys).\\\n✅ **No need to store sensitive key files.**\\\n✅ **Even if your local reference file is deleted, you can restore it anytime.**\n\n❌ **You must have access to the same YubiKey and remember your PIN to recover your resident key.**\n\n## Repository Structure\n\n```\n├── Dockerfile         # Sets up the container with OpenSSH and YubiKey Manager\n├── docker-compose.yml # Defines the Docker service for key generation\n├── keygen.sh          # The main script to generate resident keys\n└── README.md          # This documentation\n```\n\n## Contributing\n\nFeel free to open an issue or submit a pull request if you’d like to improve this project!\n\n## License\n\nMIT License\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjanthmueller%2Fyubikey-resident","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjanthmueller%2Fyubikey-resident","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjanthmueller%2Fyubikey-resident/lists"}