{"title":"2FA Everything","url":"https://seanbehan.ca/posts/2fa-everything","description":"Moving a password store between pass and KeePass, and getting two YubiKeys to guard all of it.","author":"Sean Behan","published":"2020-12-04T01:38:10.000Z","updated":null,"draft":false,"tags":["linux","security"],"readingMinutes":5,"image":null,"sections":[{"id":"password-management","text":"Password Management","level":2},{"id":"yubikey-pgp-key-generation","text":"Yubikey PGP Key Generation","level":2},{"id":"git-and-password-store-sync","text":"Git and Password Store Sync","level":2},{"id":"yubikey-for-ssh","text":"Yubikey for SSH","level":2},{"id":"bashrc","text":"~/.bashrc","level":2},{"id":"gnupggpgconf","text":"~/.gnupg/gpg.conf","level":2},{"id":"system-level-u2f-authentication","text":"System-level U2F Authentication","level":2},{"id":"before","text":"Before","level":2},{"id":"after","text":"After","level":2}],"content_format":"text/markdown","content_url":"https://seanbehan.ca/posts/2fa-everything.md","content":"### Password Management\n\nI'll start this post by saying one thing. Are you SURE you want to wipe that\n\nyubikey? I spent the last 2 weeks redoing my entire password manager. Silly me\n\nforgot that I had my passwords encrypted using the yubikey I wiped to create\n\nnew PGP keys.\n\nAnyways over the past week or two I moved all my passwords from\n\n[pass](https://www.passwordstore.org/) into [keepass](https://keepass.info/)\n\nand then back into pass when keepass didn't meet all my needs for a password\n\nmanager. KeePass supported using yubikeys for decryption, but not more than one\n\nat a time. If I were to lose the key I would get permanently locked out.\n\nFeatures I want in my password manager:\n\n- 2FA for password manager decryption\n- Mobile and desktop apps\n- Secure encryption\n\nWhat I settled on was this. I bought myself a [Yubikey 5C\n\nNFC](https://www.yubico.com/ca/product/yubikey-5c-nfc/) to go alongside my\n\nprevious [Yubikey 5C](https://www.yubico.com/ca/product/yubikey-5c/). There\n\nmight be better alternatives, but this is the one I purchased. This one had NFC\n\nand was convenient for accessing passwords on my phone and laptop.\n\n### Yubikey PGP Key Generation\n\nTo generate my PGP keys I actually generated them on the Yubikey itself, this\n\nway the private key never touches the laptop I used to generate the key.\n\n```\n$ gpg --card-edit\ngpg/card> admin\ngpg/card> key-attr\ngpg/card> generate\n```\n\nThe `key-attr` command lets you choose the type and size of key you're\n\ngenerating on the device. I used RSA 4096 for my Yubikey 5C and ed25519 for the\n\nYubikey 5C NFC. I can't use RSA or larger keys if I want to be able to use it\n\nwith NFC.\n\nI backed up my revokal certificates that were put in the `~/.gnupg/` directory\n\nas indicated after they were generated, and I exported and backed up the public\n\nkeys, then I uploaded the keys to a keyserver.\n\n```\ngpg --export --armor 0F6D5021A87F92BA > 0F6D5021A87F92BA.asc\ngpg --send-keys 0F6D5021A87F92BA\n\ngpg --export --armor F9BC985B3BF972C7 > F9BC985B3BF972C7.asc\ngpg --send-keys F9BC985B3BF972C7\n```\n\nI started putting passwords into pass using `pass init 0F6D5021A87F92BA\n\nF9BC985B3BF972C7`. That lets me encrypt to both Yubikeys at once. Now if I lose\n\nor accidentally wipe one of the Yubikeys again the other will be able to\n\ndecrypt my passwords. I also signed the keys with each other, just to show that\n\nboth are valid if one were to be lost.\n\nWhile I did all this I thought I might as well enable 2FA using both the\n\nYubikeys on every account that supported it. Google actually has something\n\ncool called Advanced Protection which allows you to set up your account with 2\n\nyubikeys to login with, so I enabled that for my Google account.\n\nI downloaded the [password\n\nstore](https://play.google.com/store/apps/details?id=dev.msfjarvis.aps) Android\n\napp for my phone, along with [Openkeychain](https://www.openkeychain.org/).\n\nThis part wasn't too hard to set up, I just searched for my key on the\n\nkeyserver that I just uploaded it to, then imported it. I went through the\n\nsetup to add a security token and imported it so that it was recognized as one\n\nof my keys.\n\n### Git and Password Store Sync\n\nAt this point I set up my password store with git to use for syncing. I set it\n\nup on some mirrors just in case one went down, and I backed it up to Nextcloud.\n\n```\ngit remote add all git@seanbehan.dev:pass\ngit remote set-url --add --push all git@seanbehan.dev:pass\ngit remote set-url --add --push all git@git.sr.ht:~codebam/pass\ngit remote set-url --add --push all git@git.maych.in:codebam/password-store\ngit push --set-upstream all master\n```\n\nI actually set up git on my own server here too. To do this I added a new user\n\nnamed `git` and added my ssh keys to it, then inside it's home directory I made\n\ngit repositories to push to using.\n\n```\nmkdir pass\ncd pass\ngit init --bare\n```\n\n### Yubikey for SSH\n\nI generated a new SSH key from within the password store app and used that for\n\nauthentication from my phone. On my laptop I set up gpg-agent with ssh support\n\nso that I could use my yubikey as an SSH key as well as a PGP key.\n\n### `~/.bashrc`\n\n```sh\nexport GPG_TTY=\"$(tty)\"\nexport SSH_AUTH_SOCK=\"/run/user/$UID/gnupg/S.gpg-agent.ssh\"\ngpg-connect-agent updatestartuptty /bye > /dev/null\n```\n\n### `~/.gnupg/gpg.conf`\n\n```conf\nuse-agent\n```\n\nThen I used `ssh-add -L` to show my public SSH key for each yubikey to put on\n\nthe server.\n\nI used pass for 2FA as well because the password store app supports that. I\n\njust scanned the code and installed `pass-otp` on Fedora to get support for\n\nOTPs.\n\nI installed the [PassFF](https://github.com/passff/passff) Firefox extention to\n\nget support for pass in my browser, and turned on autofill on my phone so that\n\nit can autofill everywhere.\n\nI set up git to sign all my commits so that it shows that my commits are signed\n\nand valid.\n\n```\ngit config --global user.signingkey 0F6D5021A87F92BA\ngit config --global commit.gpgsign true\n```\n\n### System-level U2F Authentication\n\nAs an extra layer of security on Fedora I installed the `pam-u2f` package on\n\nand generated U2F logins.\n\n```\nsudo pamu2fcfg -uroot >> /etc/u2f_mappings\n```\n\nI ran it once for each key, then opened the file and edit it so it looked like\n\nthis.\n\n### Before\n\n```\nroot:key1root:key2\n```\n\n### After\n\n```\nroot:key1:key2\ncodebam:key1:key2\n```\n\nIn `/etc/pam.d/system-auth` I added a line to the very top above all the other\n\n`auth`.\n\n```\nauth\t    required              pam_u2f.so authfile=/etc/u2f_mappings\n```\n\nI added the same line to `/etc/pam.d/su` as well so that my user and root\n\nrequires a yubikey to `su`.\n\nThis makes it so that `sudo`, `su`, and logging in through a `getty` (not in\n\nGDM for some reason, but I haven't fixed it) require you to tap the yubikey\n\nbefore typing the password. Two factors of authentication for my computer, and\n\nevery online service that supports it, backed by hardware.\n\nOnce I was done all this I committed my changes to my dotfiles pushed them to\n\ngit so that I could easily set the same thing up on my desktop which is also\n\nrunning Fedora.\n"}