How-To: Use a FIDO2 Security Key for SSH on Linux

With Launchpad adding hardware-bound tokens this week, here’s the simple version for SSH. With a FIDO2 key, a stolen private key file is useless unless the attacker also has your physical key.

What you need

• A FIDO2 security key and OpenSSH 8.2 or newer on both ends (any current distro).
• libfido2 installed (on Arch/Omarchy: sudo pacman -S libfido2).

Steps

1. Plug in the key and set a PIN if it doesn’t have one yet.
2. Make a key that requires touch and PIN:
   ssh-keygen -t ed25519-sk -O resident -O verify-required -C "fido2-ssh"
   Drop -O resident if you’d rather keep the key handle only on this machine.
3. Copy the public key to the server: ssh-copy-id -i ~/.ssh/id_ed25519_sk.pub you@server
4. Test it. You should get a PIN prompt and the key should blink for a touch.
5. Once it works, set PasswordAuthentication no in sshd_config on the server and reload sshd. Keep a second session open while you test so you don’t lock yourself out.
6. Register a backup key the same way and store it somewhere safe.

Gotchas

• On a new machine, a resident key can be pulled back down with ssh-keygen -K.
• Automation and bots can’t touch a key, so give them separate, tightly scoped keys instead.

God Bless, and Happy hacking!

References & Further Reading

• Securing SSH with FIDO2 (Yubico)
• ssh-keygen(1) manual (OpenBSD)
• OpenSSH 8.2 release notes (FIDO/U2F support)
• SSH keys (ArchWiki)