Configure two YubiKeys without losing access

MFA for critical accounts

Enroll both YubiKeys separately on GitHub, Cloudflare, or another WebAuthn-compatible identity provider. Test each key independently.

Reference : FIDO Alliance

SSH login to a host or workstation

Use an already-enrolled ed25519-sk hardware identity. Authentication normally requires touch and optionally PIN.

ssh -V
ssh -i ~/.ssh/id_ed25519_sk user@host.example

Reference : Yubico SSH FIDO2

Hardware SSH Git commit signing

Sign commits with a dedicated FIDO-backed SSH identity, preferably separate from the SSH login key.

git config --local gpg.format ssh
git config --local user.signingkey "$HOME/.ssh/id_ed25519_sk_git_signing.pub"
git config --local commit.gpgsign true

Reference : Yubico Git FIDO2

GPG-signed Git commits and tags

Use an OpenPGP signing subkey stored on the YubiKey. Git invokes gpg-agent and may require touch/PIN.

gpg --card-status
git config --local gpg.format openpgp
git config --local user.signingkey "$GPG_SIGNING_FINGERPRINT"
git config --local commit.gpgsign true

Reference : GitHub signing commits

Encrypted workstation development secrets

Keep sensitive configuration encrypted in Git and inject it only when needed. SOPS uses an age recipient, either software-based or via a YubiKey plugin.

sops edit config/dev.enc.yaml
sops exec-env config/dev.enc.yaml 'just dev-up'

Reference : SOPS

SOPS secrets protected by a YubiKey-backed age identity

Decrypt workstation development secrets using an already-provisioned YubiKey age identity, without persisting plaintext. Access follows the configured device PIN/touch policy.

age-plugin-yubikey --list
SOPS_AGE_KEY_FILE="$HOME/.config/sops/age/yubikey-identity.txt" \
  sops exec-env config/dev.enc.yaml 'just dev-up'

Reference : age-plugin-yubikey

Hardware-backed file encryption with age

After explicitly approved age-plugin-yubikey provisioning, encrypt for the hardware recipient and decrypt with the plugin identity file.

age-plugin-yubikey --list
age -r "$AGE_YUBIKEY_RECIPIENT" -o artifact.age artifact.txt
age -d -i "$AGE_YUBIKEY_IDENTITY_FILE" artifact.age | sha256sum

Reference : age-plugin-yubikey

Stream-encrypted PostgreSQL backup

Encrypt a pg_dump stream directly without creating an intermediate plaintext dump. Use multiple independent recovery recipients.

set -o pipefail
pg_dump -Fc --no-owner "$PGDATABASE" | age -R recipients.txt -o postgres.dump.age
age -d -i "$AGE_IDENTITY_FILE" postgres.dump.age | pg_restore --list

Reference : PostgreSQL pg_dump

GPG signing a PostgreSQL backup

Add a detached signature to an already encrypted archive to verify origin and integrity before a restore.

gpg --local-user "$GPG_SIGNING_FINGERPRINT" --detach-sign --armor --output postgres.dump.age.asc postgres.dump.age
gpg --verify postgres.dump.age.asc postgres.dump.age

Reference : GnuPG

PIV authentication and signing certificates

Inspect the slot 9a authentication certificate, its issuer and expiration. For TLS client authentication, configure PKCS#11 middleware.

ykman piv info
ykman piv certificates export 9a auth-public.pem
openssl x509 -in auth-public.pem -noout -subject -issuer -dates

Reference : Yubico PIV

Vaultwarden vault MFA

Use WebAuthn/FIDO2 for vault login, enroll a second key independently and verify offline recovery codes.

Reference : Bitwarden two-step login

Vault login through an identity provider

Protect human HashiCorp Vault login with an OIDC identity provider enforcing FIDO2/WebAuthn; Vault can also apply supported native MFA methods.

vault login -method=oidc

Reference : HashiCorp Vault MFA

KeePassXC challenge-response unlock

Bind a KeePassXC database to the YubiKey HMAC-SHA1 OTP challenge-response slot. Plan independent recovery.

Reference : KeePassXC

Time-based one-time passcodes

Keep OATH-TOTP credentials on the YubiKey and obtain codes through Yubico Authenticator when WebAuthn is unavailable.

Reference : Yubico Authenticator