Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ability to load yubikey management keys from a file #207

Open
rmb938 opened this issue Jan 10, 2025 · 2 comments · May be fixed by smallstep/crypto#676
Open

Add ability to load yubikey management keys from a file #207

rmb938 opened this issue Jan 10, 2025 · 2 comments · May be fixed by smallstep/crypto#676
Assignees
@maraino

Comments

@rmb938
Copy link

rmb938 commented Jan 10, 2025 •
edited
Loading

Currently when using kms with a yubikey it seems like the only way to give step-kms-plugin the management key is via the command line.

Like environment variables mentioned here https://smallstep.com/docs/step-ca/certificate-authority-server-production/#avoid-storing-passwords-in-environment-variables command line arguments also are not that secure, any user can see them in ps or the /proc filesystem.

It would be useful to be able to do something like yubikey:management-key-source=/etc/step/yubikey-pin for example.

Step CA already has this covered since the keys and pins are in the ca.json so this is really only needed when used via the command line.
@hslatman
Copy link
Member

hslatman commented Jan 10, 2025 •
edited
Loading

Hey @rmb938,

You mean just the YubiKey management key, right? For PINs it should already be possible using pin-source=/path/to/pin.txt.

It does make sense to support management-key-source=/path/to/mgmtkey.txt.

As mentioned on Discord, it might be nice to support prompting in an interactive context, but that'll take more work.

@rmb938
Copy link
Author

rmb938 commented Jan 10, 2025

Yes, I'll update the since you mentioned the pin source.

@rmb938 rmb938 changed the title Add ability to load yubikey management keys and pins from a file Add ability to load yubikey management keys from a file Jan 10, 2025
maraino added a commit to smallstep/crypto that referenced this issue Jan 14, 2025
@maraino
support for yubikey management key from a file
3076b91 
This commit adds the yubikey attribute management-key-source. This
attribute can be used to pass the yubikey management key from a file.

Fixes smallstep/step-kms-plugin#207
@maraino maraino linked a pull request Jan 14, 2025 that will close this issue
Open
maraino added a commit to smallstep/crypto that referenced this issue Jan 14, 2025
@maraino
support for yubikey management key from a file
f3ae27e 
This commit adds the yubikey attribute management-key-source. This
attribute can be used to pass the yubikey management key from a file.

Fixes smallstep/step-kms-plugin#207
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@maraino maraino

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

support for yubikey management key from a file smallstep/crypto
3 participants
@maraino @rmb938 @hslatman