[pipe_connector]

How do you authenticate from a machine that isn't local to you? I don't do any work on my work-issued laptop, I use a powerful remote machine instead.

[johncolanduoni]

Newer openssh clients and servers can use FIDO2-augmented private keys (these are the key types like ed25519-sk). Basically you have a normal keypair stored on the client device, plus the server requires a passing a FIDO2 challenge against the yubikey.

[pipe_connector]

Maybe I'm just missing something, let me explain:

I've already ssh'd to my work machine. I want to send an HTTP request to my company's internal web API from that machine, but we only use webauthn credentials. I'm going to use curl to send the request to the web API. With basic username/password auth or totp it's easy for me to write a script that prompts me for my password/totp code and marshals in into the expected format. How do I do this with my FIDO2 private key in a way that doesn't completely undermine the whole process?

[deng]

In your ssh config:

    Host my-trusted-powerful-remote-machine.whatever.com
        ForwardAgent yes

There is still one problem if you like to re-use long-running screen/tmux sessions, for a solution to this see for instance https://gist.github.com/martijnvermaat/8070533

[pipe_connector]

Doesn't this only solve the problem for resources I am accessing over SSH? What about if I wanted to access something over HTTP like my web browser does?

[visualphoenix]

If the remote host is trusted, you just forward the gpg-agent over ssh to your remote host.

[pipe_connector]

Sorry, I think I missed something because the article doesn't mention GPG at all. How can you make a webauthn client defer to gpg-agent?