Protecting SSH with FIDO2 / U2F Hardware Keys on Linux

Traditional SSH keypairs (such as id_ed25519 or id_rsa) are stored as text files on the developer's laptop. Even when encrypted with a passphrase, the decrypted private key is loaded into memory by ssh-agent where sophisticated info-stealer malware or compromised development dependencies can exfiltrate it. Once a private key is copied by an adversary, they possess permanent access until the key is identified and revoked.

OpenSSH security key credentials (ed25519-sk and ecdsa-sk) completely solve private key theft by anchoring authentication in physical FIDO2 / U2F hardware security keys (such as YubiKeys or Nitrokeys). The private key never leaves the secure cryptographic element on the physical USB hardware token. Furthermore, the token enforces user presence: every single authentication request requires a physical tap on the key.

Expand

Generating FIDO2 Hardware-Backed SSH Keys

Insert your FIDO2 security token and generate an ed25519-sk keypair. We recommend enabling resident credentials (allowing you to discover keys on any new machine) and mandatory user verification (PIN verification):

# Generate resident, PIN-protected FIDO2 key
ssh-keygen -t ed25519-sk -O resident -O verify-required -f ~/.ssh/id_ed25519_sk -C "admin-yubikey-primary"

# You will be prompted to enter your security key PIN and physically touch the key

This produces two files on your laptop:

• id_ed25519_sk.pub: The public key containing your token identifier.
• id_ed25519_sk: A small key handle stub that instructs ssh to interact with the USB token.

Enforcing FIDO2 Keys on the Server

On your production VPS, append the public key to ~/.ssh/authorized_keys:

# Sample line in ~/.ssh/authorized_keys
sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAI... admin-yubikey-primary

To enforce that the server rejects any connection where the user did not physically tap the key, prefix the authorized_keys entry with no-touch-required negation or configure /etc/ssh/sshd_config:

# /etc/ssh/sshd_config
# Disallow legacy password and DSA/RSA keys
PasswordAuthentication no
PubkeyAcceptedAlgorithms +sk-ssh-ed25519@openssh.com

# Enforce hardware touch verification
PubkeyAuthOptions verify-required

Reload the daemon:

sudo systemctl reload sshd

Public Key Cryptography Video

Learn how asymmetric cryptography and hardware-backed signing protocols protect identity:

Recovering Keys on a New Machine

Because we utilized -O resident, you do not need to copy key files when switching workstations. Simply plug in your USB key and extract your credentials into the local agent:

# Discover resident credentials stored inside the hardware key
ssh-add -K

Protect mission-critical cloud instances with modern cryptographic authentication on Netbay at netbayhosts.in.