GPGTools+SSH+Yubikey+MacOS中文教程

还在手动输入用户名密码登录ssh被pandada嘲讽后，一鼓作气换成GPGTools+ssh+yubikey
中间走了不少弯路，写下来望各位绕道而行

1.安装GPGTools

Mac用户在GPGTools官网下载，这是一款GUI的GPG管理软件，也会自动装上gpg-agent无需另行下载

1.安装Yubikey管理软件

$ brew install yubikey-personalization

2.插入Yubikey

3.设置Yubikey为OTP and OpenPGP模式

$ ykpersonalize -m82

4.重新设置Yubikey的PIN码（Admin PIN和PIN初始都为123456）

按照下列指令输入

$ gpg --card-edit
<省略中间Yubikey信息>

gpg/card> admin
Admin commands are allowed

gpg/card> passwd
1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit
Your selection? 3

输入完成后会弹出GUI要求输入初始Admin PIN，这个时候输入123456，然后要求你输入新的Admin PIN。

修改Admin PIN完成后显示以下回显，选择1

PIN changed.

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? 1

输入完成后会弹出GUI要求输入初始PIN，这个时候输入123456，然后要求你输入新的PIN。

PIN changed.

1 - change PIN
2 - unblock PIN
3 - change Admin PIN
4 - set the Reset Code
Q - quit

Your selection? q 

1.生成公私钥

$ gpg --card-edit
gpg/card> admin
gpg/card> generate
Make off-card backup of encryption key? (Y/n) Y

<输入Admin PIN>
<输入PIN>

Please specify how long the key should be valid.
            0 = key does not expire
           = key expires in n days
         w = key expires in n weeks
         m = key expires in n months
         y = key expires in n years
Key is valid for? (0) 1y <密钥有效期一年>
<省略密钥信息>
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <[email protected]>"

Real name: <随意写就好>
Email address: <邮箱>
Comment: <可选>
You selected this USER-ID:
<接下来需要花几分钟生成keys>

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
gpg: generating new key
gpg: please wait while key is being generated ...
gpg: key generation completed (45 seconds)
gpg: signatures created so far: 0
gpg: signatures created so far: 0
You need a Passphrase to protect your secret key.
<弹出GUI要求输入密码保护secret key>


gpg: signatures created so far: 2
gpg: signatures created so far: 2
gpg: generating new key
gpg: please wait while key is being generated ...
gpg: key generation completed (25 seconds)
gpg: signatures created so far: 4
gpg: signatures created so far: 4
gpg: key  marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
pub   2048R/79C56617 2015-08-25
Key fingerprint = ...
uid   ...
sub   2048R/... ...
sub   2048R/... ...
</[email protected]>

2.导出公钥

gpg --armor --export  > ~/my_gpg_public_key.pub

3.运行安装好的GPG Keychain，并且在该公钥右键选择Generate Revoke Certificate，如果你弄丢了Yubikey，就需要这个来撤销

4.右键该公钥选择Send public key to Keyserver

1.配置gpg-agent.conf

$ vim ~/.gnupg/gpg-agent.conf

接下来复制粘贴以下内容

pinentry-program /usr/local/MacGPG2/libexec/pinentry-mac.app/Contents/MacOS/pinentry-mac
default-cache-ttl 600
max-cache-ttl 7200
enable-ssh-support

2.配置gpg-agent自启

$ vim ~/.bash_profile
#根据shell的不同自己选择配置文件

在末尾添加

GPG_TTY=$(tty)
export GPG_TTY
if [ -f "${HOME}/.gpg-agent-info" ]; then
    . "${HOME}/.gpg-agent-info"
    export SSH_AUTH_SOCK=~/.gnupg/S.gpg-agent.ssh
fi

RESULT=`pgrep -x "gpg-agent"`
#echo ${RESULT};
if [ "${RESULT}" > /dev/null ]; then
else
    eval $(gpg-agent --daemon --enable-ssh-support)
fi

它的作用是先告诉ssh我要用gpg-agent，再看看gpg-agent是否在运行，如果没有，就运行gpg-agent

1.导出公钥成ssh可理解的形式

$ gpg --export-ssh-key  > ~/ssh_public_key.pub

2.上传公钥到要登录的服务器

$ scp -P 22 ~/ssh_public_key.pub <用户名>@:~/

3.登录服务器，将上传的公钥放在.ssh目录下并更名，赋予权限

<登录步骤省略>

$ mv ~/ssh_public_key ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys
$ chmod 700 ~/.ssh

4.修改ssh配置文件

$ vim /etc/ssh/sshd_config

然后找到RSAAuthentication和PubkeyAuthentication，去掉注释，并把后面跟随值改为yes，如果没有这一项则手动添加

RSAAuthentication yes
PubkeyAuthentication yes

最后重启sshd服务

$ service sshd restart

当你使用密钥登录后，可以去sshd_config文件把PasswordAuthentication值设置为no

现在你每次登录都需要插入Yubikey，并且会弹出GUI让你输入PIN码，如果输入正确，会有一段时间的cache保证下次登录不需要输入PIN。