mirrors
/
YubiKey-Guide
mirror of https://github.com/drduh/YubiKey-Guide
0
0
Fork 0
Code Releases Activity

use printf, export keyid, fix link

pull/458/head
drduh 2024-08-18 11:47:11 -07:00
parent 59caacc134
commit c110bb8ec0
1 changed files with 5 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
README.md
View File

@ -348,7 +348,7 @@ This guide recommends a two year expiration for Subkeys to balance security and
When Subkeys expire, they may still be used to decrypt with GnuPG and authenticate with SSH, however they can **not** be used to encrypt nor sign new messages.
Subkeys must be renewed or rotated using the Certify key - see [Updating Subkeys](#updating-subkeys).
Subkeys must be renewed or rotated using the Certify key - see [Updating keys](#updating-keys).
Set the expiration date to two years:
@ -371,7 +371,7 @@ The following commands will generate a strong passphrase and avoid ambiguous cha
```console
export CERTIFY_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \
tr -d "1IOS5U" | fold -w 30 | sed "-es/./ /"{1..26..5} | \
cut -c2- | tr " " "-" | head -1) ; echo "\n$CERTIFY_PASS\n"
cut -c2- | tr " " "-" | head -1) ; printf "\n$CERTIFY_PASS\n\n"
```
Write the passphrase in a secure location, ideally separate from the portable storage device used for key material, or memorize it.
@ -511,7 +511,7 @@ Generate another unique [Passphrase](#passphrase) (ideally different from the on
```console
export LUKS_PASS=$(LC_ALL=C tr -dc 'A-Z1-9' < /dev/urandom | \
tr -d "1IOS5U" | fold -w 30 | sed "-es/./ /"{1..26..5} | \
cut -c2- | tr " " "-" | head -1) ; echo "\n$LUKS_PASS\n"
cut -c2- | tr " " "-" | head -1) ; printf "\n$LUKS_PASS\n\n"
```
This passphrase will also be used infrequently to access the Certify key and should be very strong.
@ -912,8 +912,7 @@ Install the required packages:
```console
sudo apt update
sudo apt install -y \
gnupg gnupg-agent gnupg-curl scdaemon pcscd
sudo apt install -y gnupg gnupg-agent scdaemon pcscd
```
**OpenBSD**
@ -969,7 +968,7 @@ Determine the key ID:
```console
gpg -k
KEYID=0xF0F2CFEB04341FB5
export KEYID=0xF0F2CFEB04341FB5
```
Assign ultimate trust by typing `trust` and selecting option `5` then `quit`:
@ -1351,14 +1350,6 @@ To launch `gpg-agent` for use by SSH, use the `gpg-connect-agent /bye` or `gpgco
Add the following to the shell rc file:
```console
export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
gpg-connect-agent updatestartuptty /bye > /dev/null
```
On modern systems, `gpgconf --list-dirs agent-ssh-socket` will automatically set `SSH_AUTH_SOCK` to the correct value and is better than hard-coding to `run/user/$UID/gnupg/S.gpg-agent.ssh`, if available:
```console
export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)