Monday, August 3, 2015

YubiKey Neo + Putty SSH + Windows

I have been using Yubikey Neo to manage my OpenSSH key in a CCID at work. I have made it work in Ubuntu and MacOS with relative ease, but most of my colleagues are on Windows and wondered how this could be done on the M$ platform. So I decided to give it a shot and try it out on their newly released Windows 10 (or shall we call it WinOS X )

Step 0: Get YubiKey Neo configured as CCID

Of course you have to buy this hardware before we can even begin. Before your Yubikey appears as a CCID  you will need to use YubiKey Neo Manager to enable it. See the following screenshot. 

You cannot have a password for your Yubikey when you are changing the modes. If you do then you will have to delete that configuration with YubiKey personalization tool. Make sure to exit the GUI applications before you start using console later.

Step 1: Check if you Yubikey works.

You will need have gpg executable installed. Gpg4Win to interact with your Yubikey

C:\>gpg --card-edit
gpg: detected reader `Yubico Yubikey NEO OTP+U2F+CCID 0'
Application ID ...: REDACTED
Version ..........: 2.0
Manufacturer .....: unknown
Serial number ....: REDACTED
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: 2048R 2048R 2048R
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 0
Signature key ....: [none]
Encryption key....: [none]
Authentication key: [none]
General key info..: [none]

A caveat here is that a few months back there was an advisory regarding Yubikeys with OpenPGP applet version ≤ 1.0.9 being compromised. See the website to make sure that the key you have has non compromised version. 

Step 2: Generate Keys

Now you can do things in steps described in some blog entries. Just make sure that you use the correct PINs the first time (the console will tell you default pins, otherwise you may have to RESET your applet)

gpg/card> generate
Make off-card backup of encryption key? (Y/n) n

Please note that the factory settings of the PINs are
   PIN = `123456'     Admin PIN = `12345678'
You should change them using the command --change-pin

gpg: 3 Admin PIN attempts remaining before card is permanently locked

Please enter the Admin PIN

Please enter the PIN
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at 08/02/16 15:18:08
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <>"

Real name: User Name
Email address:
Comment: Department
You selected this USER-ID:
    "User Name <>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? C
Comment: Department2
You selected this USER-ID:
    "User Name (Department 2) <>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
gpg: generating new key
gpg: please wait while key is being generated ...
gpg: key generation completed (25 seconds)
gpg: signatures created so far: 0
gpg: generating new key
gpg: please wait while key is being generated ...
gpg: key generation completed (26 seconds)
gpg: signatures created so far: 1
gpg: signatures created so far: 2
gpg: generating new key
gpg: please wait while key is being generated ...
gpg: key generation completed (34 seconds)
gpg: signatures created so far: 3
gpg: signatures created so far: 4
gpg: C:/Users/hatsha/AppData/Roaming/gnupg\trustdb.gpg: trustdb created
gpg: key 60C2B662 marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2016-08-02
pub   REDACTED/REDACTED 2015-08-03 [expires: 2016-08-02]
      Key fingerprint = 5ABF D138 BB53 3F9C 133D  DD9A 793B D949 60C2 B662
uid                  User Name (Department 2) <>
sub   2048R/REC2015-08-03 [expires: 2016-08-02]
sub   2048R/D0AD1A73 2015-08-03 [expires: 2016-08-02]

Step 3: Use Keys

Next step is to use the generated SSH Key. The easiest way I have found on  Windows is to use an agent that requires a registration. The fee is nominal (1 Euro)/key. After following the instructions you can start the agent and should see keys in the agent if Yubikey pgp is working

While you can export the SSH key out of pgp (so you can put it in your servers/opsworks stack). I just take the easy route and login to a server with password and do an ssh-add -L to get the keys. Don't forget to forward your key from putty though.

Friday, April 3, 2015

Securing your Ansible deployment on AWS

Lately I have been involved in a team which is developing software as micro-services. It is very interesting work and has helped me to get introduced to some interesting technologies such as AWS Ansible and Docker in depth (and in practice).

Ansible is a great deployment automation tool. It is made in python, is declarative and agent-less (i.e. it just needs SSH access to your box). SSH it self is very secure if you use key based authentication. But people tend to use it in very insecure manner (i.e they share SSH keys on email, don't delete old SSH keys once they are revoked etc).

In my opinion the best solution to stop sharing of private keys is to generate them on a hardware token from which they cannot be (easily) copied. Fortunately I have access to Yubico Neo on which I managed to generate a public/private gpg key. The private key resides in your gpg card and public key can be put in your Ansible target hosts. There are quite a few guides (Mac, Linux, Windows) for Yubikey and few more for general purpose CCID based key-stores. And then one can use SSH key forwarding with your Gpg agent so that you can use your Yubikey for servers which require you to first login to jumpboxes.

Ansible has good AWS support in form of modules such as ec2, rds etc (backed by python boto). These modules of-course require AWS api access when trying to conjure/terminate nodes or updating a route53 DNS entry. Normally this means you have to generate and use AWS API tokens. I prefer using jump-boxes with IAM roles instead (IAM roles essentially gives permission to an Amazon instance to call Amazon APIs on your behalf, without requiring any extra keys or passwords etc). 

So this entire approach will be useful only if you can easily login to a jumpbox with IAM role. I like the using OpsWorks to create and start such jumpbox instances. The only thing required for such jumpboxes is to have correct IAMroles (which can do all the things that you need to do from your Ansible scripts, i.e EC2.* or S3.*) and your IAM users have the permission to SSH to the jumpbox. IAM users can register their own SSH keys (of-course the one generated on Yubikey) on OpsWorks. And they keys get magically updated on all machines managed by Opsworks.

Following this guide you make it impossible to leak your SSH key or Amazon credentials, since you don't put them in any remote machine/code. And that should be a good baseline for a secure Ansible deployment on AWS.