Authenticate SSH with Your TPM

https://fed.brid.gy/r/https://hackaday.com/2026/04/11/authenticate-ssh-with-your-tpm/

Anyone got an idea how to do this:

• expose a user on a GNU/Linux system via ssh
• allow two keys access
  • one is the “self” key, which should be allowed as-is
  • the other is the “external” key, which triggers a password prompt
• otherwise, password login is not permitted

I know how to do most things of this, but not all at once (AuthenticationMethods is permitted in a Match block, but we cannot match on keys, we want access to the same user, and the “self” key can also be used (agent forwarding) from nōn-local addresses.

It seems like I’ll need a custom PAM module (arrrgh, I don’t want to write one of these) that asks for the password if key B is used (does SSH expose this to PAM?).

Anyone got a better idea?

#ssh #openssh #sshkeys #pam

Want to manage your deployments securely with DeployHQ? Learn how to create SSH keys from the command line using 5 different algorithms and configurations.
#SSHKeys #DeployHQ #Security #DevOps #ServerManagement

https://buff.ly/3MELUlz

in case you may have not known, if you have a #yubikey or an #onlykey or something similar you can generate SSH keys that require them, for example:

`ssh-keygen -t ed25519-sk`

more info:

https://security.stackexchange.com/a/240992

#SSH #security #ed25519 #sshkeys #linux #openssh