Secure SSH on Ubuntu with YubiKey 2FA

SSH access is the primary gateway for managing Linux servers. Although SSH keys are more secure than passwords, risks remain if a private key file is leaked or stolen from a sysadmin's laptop. To close this vulnerability, we can add a FIDO2/U2F hardware security key such as YubiKey by Yubico as a second verification layer. Every SSH login will then require physical contact with the device, preventing an attacker who only possesses the private key file from entering the server.

SSH Authentication Methods

SSH supports several authentication methods:

1. Password Authentication: The simplest method, but also the most vulnerable to brute-force attacks or password theft.
2. Public Key Authentication: Uses a pair of public and private keys. It is more secure than passwords, but if the private key is leaked, server access can still be compromised.
3. Host-based Authentication: Relies on trust between hosts. Rarely used on public servers.
4. Keyboard-Interactive / Challenge-Response: Allows additional methods such as OTP (One-Time Password), enabling integration with 2FA.

In best practices, sysadmins usually disable password authentication and rely solely on SSH keys. However, adding 2FA based on a hardware token like YubiKey significantly enhances the security layer.

Two-Factor Authentication

Two-Factor Authentication (2FA) is an authentication method that combines two different verification layers. It typically consists of:

• Something you know → a password or passphrase.
• Something you have → a physical device such as a token or smartphone.
• Something you are → biometrics, such as a fingerprint.

2FA ensures that even if a private key or password is leaked, an attacker still cannot log in without the physical device, which in this case is the YubiKey.

YubiKey as a Security Key

YubiKey is a hardware device made by Yubico that serves as a security key for multi-factor authentication. YubiKey supports various security protocols, including:

• OTP (One-Time Password)
• FIDO2 / U2F
• PIV (Personal Identity Verification)
• OpenPGP
• Challenge-Response

In the context of SSH, YubiKey acts as a second factor. Every SSH login automatically requires a physical touch on the YubiKey device.

FIDO2 Package Installation

Ensure that the installed OpenSSH package supports FIDO2, which requires OpenSSH version 8.2 or higher. On Ubuntu Server 26.04 LTS, the official repository provides OpenSSH 10.2 along with supporting FIDO2 packages such as libfido2. Follow these steps to install the dependencies:

1. Update the package list:

   sudo apt update

2. Install the FIDO2/U2F support packages:

   sudo apt install libfido2-1 libfido2-dev libu2f-udev -y

3. Check the installed OpenSSH version:

   ssh -V

   If the displayed version is ≥ 8.2, FIDO2 support is available.

FIDO2 Configuration for SSH

Plug the YubiKey into a USB port, then follow these steps to generate a FIDO2-based SSH key:

1. Generate a new key pair using the -sk flag:

   ssh-keygen -t ed25519-sk -C "user@server"

   The -sk flag indicates the use of a security key (FIDO2/U2F). Touch the YubiKey when prompted to complete the key creation.
2. The command above produces two files: the private key id_ed25519_sk and the public key id_ed25519_sk.pub.
3. Copy the public key to the server:

   ssh-copy-id -i ~/.ssh/id_ed25519_sk.pub user@Server-IP

Testing SSH Login

After the public key is copied to the server, attempt to log in:

ssh -i ~/.ssh/id_ed25519_sk user@Server-IP

The sysadmin will be prompted to touch the YubiKey before the connection is successfully established. If the YubiKey is not plugged in, the authentication process will automatically fail even if the private key is available on disk.

The combination of FIDO2 and YubiKey provides a physical security layer for SSH authentication. Having the private key alone is not enough without the YubiKey plugged in, preventing anyone who steals the key file from logging into the server. This method is simpler than PAM-based OTP and stronger because it integrates directly with modern OpenSSH. For sysadmins and security engineers, combining FIDO2-based SSH with disciplined key management is the most effective step to protect Ubuntu servers from unauthorized access.