ssh: T7483: Add fido2 PubkeyAuthOptions #4852

scj643 · 2025-11-17T17:01:50Z

Change summary

Add PubkeyAuthOptions to allow requiring touch and user verification.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Code style update (formatting, renaming)
Refactoring (no functional changes)
Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
Other (please describe):

Related PRs

ssh: T7483: Document fido2 options vyos-documentation#1708

Related Task(s)

https://vyos.dev/T7483

How to test / Smoketest result

Run ssh with these options enabled and verify that it requires touch and pin verification.

Checklist:

I have read the CONTRIBUTING document
I have linked this PR to one or more Phabricator Task(s)
I have run the components SMOKETESTS if applicable
My commit headlines contain a valid Task id
My change requires a change to the documentation
I have updated the documentation accordingly

github-actions · 2025-11-17T17:02:07Z

👍
No issues in PR Title / Commit Title

dmbaturin

This is certainly a useful addition. I'm not a big fan of the name verify-required and might prefer that syntax to be require <verification|touch>.

The current syntax mirrors OpenSSH options from https://man.openbsd.org/sshd_config#PubkeyAuthOptions that might be familiar to OpenSSH users. This is a purely aesthetic considerations and I don't consider it a blocker for merging this PR.

c-po

Hi @scj643,

thanks for the contribution - as @dmbaturin already outline the CLI could be improved. Let me throw in another idea:

set service ssh fido pin-required
set service ssh fido touch-required

scj643 · 2025-11-20T15:57:59Z

Hi @scj643,

thanks for the contribution - as @dmbaturin already outline the CLI could be improved. Let me throw in another idea:
set service ssh fido pin-required

set service ssh fido touch-required

That sounds great. I'll change that later today.

scj643 · 2025-11-20T17:04:00Z

Changes made and updated the documentation.

c-po · 2025-11-20T17:44:18Z

The documentation could use an example on how to set this up and get it working. Please also extend the SSH Smoketests to verify the CLI nodes actually males it into the sshd_config

scj643 · 2025-11-24T16:55:51Z

The documentation could use an example on how to set this up and get it working.

So an example of setting up the SSH server to only accept fido keys?

dmbaturin

The new syntax looks fine to me, I'm happy to approve it.

github-actions · 2025-11-24T19:27:55Z

CI integration ❌ failed!

Details

CI logs

CLI Smoketests (no interfaces) ❌ failed
CLI Smoketests VPP 👍 passed
CLI Smoketests (interfaces only) ❌ failed
Config tests ❌ failed
Config tests VPP 👍 passed
RAID1 tests 👍 passed
TPM tests 👍 passed

sever-sever

Smoketests fails

DEBUG - Running Testcase: /usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py
DEBUG - test_ssh_default (__main__.TestServiceSSH.test_ssh_default) ... ok
DEBUG - test_ssh_dynamic_protection (__main__.TestServiceSSH.test_ssh_dynamic_protection) ... ok
DEBUG - test_ssh_fido (__main__.TestServiceSSH.test_ssh_fido) ... FAIL
DEBUG - test_ssh_login (__main__.TestServiceSSH.test_ssh_login) ... ERROR
DEBUG - test_ssh_login (__main__.TestServiceSSH.test_ssh_login) ... FAIL
DEBUG - test_ssh_multiple_listen_addresses (__main__.TestServiceSSH.test_ssh_multiple_listen_addresses) ... FAIL
DEBUG - test_ssh_ndcpp (__main__.TestServiceSSH.test_ssh_ndcpp) ... FAIL
DEBUG - test_ssh_pubkey_accepted_algorithm (__main__.TestServiceSSH.test_ssh_pubkey_accepted_algorithm) ... FAIL
DEBUG - test_ssh_single_listen_address (__main__.TestServiceSSH.test_ssh_single_listen_address) ... FAIL
DEBUG - test_ssh_single_listen_address (__main__.TestServiceSSH.test_ssh_single_listen_address) ... FAIL
DEBUG - test_ssh_trusted_user_ca (__main__.TestServiceSSH.test_ssh_trusted_user_ca) ... ERROR
DEBUG - test_ssh_trusted_user_ca (__main__.TestServiceSSH.test_ssh_trusted_user_ca) ... FAIL
DEBUG - test_ssh_vrf_multi (__main__.TestServiceSSH.test_ssh_vrf_multi) ... FAIL
DEBUG - test_ssh_vrf_multi (__main__.TestServiceSSH.test_ssh_vrf_multi) ... FAIL
DEBUG - test_ssh_vrf_single (__main__.TestServiceSSH.test_ssh_vrf_single) ... FAIL
DEBUG - test_ssh_vrf_single (__main__.TestServiceSSH.test_ssh_vrf_single) ... FAIL
DEBUG - 
DEBUG - ======================================================================
DEBUG - ERROR: test_ssh_login (__main__.TestServiceSSH.test_ssh_login)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py", line 300, in test_ssh_login
DEBUG -     output, error = self.ssh_send_cmd(test_command, test_user, test_pass)
DEBUG -                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/base_vyostest_shim.py", line 201, in ssh_send_cmd
DEBUG -     ssh_client.connect(hostname=hostname, username=username,
DEBUG -   File "/usr/lib/python3/dist-packages/paramiko/client.py", line 381, in connect
DEBUG -     raise NoValidConnectionsError(errors)
DEBUG - paramiko.ssh_exception.NoValidConnectionsError: [Errno None] Unable to connect to port 22 on 127.0.0.1 or ::1
DEBUG - 
DEBUG - ======================================================================
DEBUG - ERROR: test_ssh_trusted_user_ca (__main__.TestServiceSSH.test_ssh_trusted_user_ca)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py", line 461, in test_ssh_trusted_user_ca
DEBUG -     output, error = self.ssh_send_cmd(test_command, test_user, ***
DEBUG -                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/base_vyostest_shim.py", line 201, in ssh_send_cmd
DEBUG -     ssh_client.connect(hostname=hostname, username=username,
DEBUG -   File "/usr/lib/python3/dist-packages/paramiko/client.py", line 381, in connect
DEBUG -     raise NoValidConnectionsError(errors)
DEBUG - paramiko.ssh_exception.NoValidConnectionsError: [Errno None] Unable to connect to port 22 on 127.0.0.1 or ::1
DEBUG - 
DEBUG - ======================================================================
DEBUG - FAIL: test_ssh_fido (__main__.TestServiceSSH.test_ssh_fido)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py", line 151, in tearDown
DEBUG -     self.assertTrue(process_named_running(PROCESS_NAME))
DEBUG - ======================================================================
DEBUG - FAIL: test_ssh_trusted_user_ca (__main__.TestServiceSSH.test_ssh_trusted_user_ca)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py", line 151, in tearDown
DEBUG -     self.assertTrue(process_named_running(PROCESS_NAME))
DEBUG - AssertionError: None is not true
DEBUG - 
DEBUG - ======================================================================
DEBUG - FAIL: test_ssh_vrf_multi (__main__.TestServiceSSH.test_ssh_vrf_multi)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py", line 281, in test_ssh_vrf_multi
DEBUG -     self.assertIn(PROCESS_NAME, tmp)
DEBUG - AssertionError: 'sshd' not found in ''
DEBUG - 
DEBUG - ======================================================================
DEBUG - FAIL: test_ssh_vrf_multi (__main__.TestServiceSSH.test_ssh_vrf_multi)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py", line 151, in tearDown
DEBUG -     self.assertTrue(process_named_running(PROCESS_NAME))
DEBUG - AssertionError: None is not true
DEBUG - 
DEBUG - ======================================================================
DEBUG - FAIL: test_ssh_vrf_single (__main__.TestServiceSSH.test_ssh_vrf_single)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py", line 258, in test_ssh_vrf_single
DEBUG -     self.assertIn(PROCESS_NAME, tmp)
DEBUG - AssertionError: 'sshd' not found in ''
DEBUG - 
DEBUG - ======================================================================
DEBUG - FAIL: test_ssh_vrf_single (__main__.TestServiceSSH.test_ssh_vrf_single)
DEBUG - ----------------------------------------------------------------------
DEBUG - Traceback (most recent call last):
DEBUG -   File "/usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py", line 151, in tearDown
DEBUG -     self.assertTrue(process_named_running(PROCESS_NAME))
DEBUG - AssertionError: None is not true
DEBUG - 
DEBUG - ----------------------------------------------------------------------
DEBUG - Ran 11 tests in 83.550s
DEBUG - 
DEBUG - FAILED (failures=12, errors=2)

scj643 · 2025-11-25T05:12:36Z

I think there is a deeper issue than what I added that is causing the smoke test to fail.

scj643 · 2025-11-27T15:48:34Z

@sever-sever think you could investigate that?

sever-sever

The local test looks ok

vyos@r14:~$ /usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py -k test_ssh_fido
test_ssh_fido (__main__.TestServiceSSH.test_ssh_fido) ... ok

----------------------------------------------------------------------
Ran 1 test in 3.944s

OK
vyos@r14:~$ 
vyos@r14:~$ 
vyos@r14:~$ /usr/libexec/vyos/tests/smoke/cli/test_service_ssh.py
test_ssh_default (__main__.TestServiceSSH.test_ssh_default) ... ok
test_ssh_dynamic_protection (__main__.TestServiceSSH.test_ssh_dynamic_protection) ... ok
test_ssh_fido (__main__.TestServiceSSH.test_ssh_fido) ... ok
test_ssh_login (__main__.TestServiceSSH.test_ssh_login) ... ok
test_ssh_multiple_listen_addresses (__main__.TestServiceSSH.test_ssh_multiple_listen_addresses) ... ok
test_ssh_ndcpp (__main__.TestServiceSSH.test_ssh_ndcpp) ... ok
test_ssh_pubkey_accepted_algorithm (__main__.TestServiceSSH.test_ssh_pubkey_accepted_algorithm) ... ok
test_ssh_single_listen_address (__main__.TestServiceSSH.test_ssh_single_listen_address) ... ok
test_ssh_trusted_user_ca (__main__.TestServiceSSH.test_ssh_trusted_user_ca) ... ok
test_ssh_vrf_multi (__main__.TestServiceSSH.test_ssh_vrf_multi) ... ok
test_ssh_vrf_single (__main__.TestServiceSSH.test_ssh_vrf_single) ... ok

----------------------------------------------------------------------
Ran 11 tests in 52.138s

OK
vyos@r14:~$

github-actions bot assigned scj643 Nov 17, 2025

github-actions bot added the current label Nov 17, 2025

ssh: T7483: Add fido2 PubkeyAuthOptions

eef18e3

scj643 force-pushed the ssh-fido2-options branch from 90e587d to eef18e3 Compare November 17, 2025 17:04

scj643 mentioned this pull request Nov 17, 2025

ssh: T7483: Document fido2 options vyos/vyos-documentation#1708

Open

1 task

sever-sever requested review from c-po, dmbaturin, jestabro and sever-sever November 17, 2025 22:59

dmbaturin approved these changes Nov 20, 2025

View reviewed changes

c-po reviewed Nov 20, 2025

View reviewed changes

ssh: T7483: Update fido2 option names

0310c83

scj643 requested a review from c-po November 20, 2025 17:08

ssh: T7483: Fix sshd template indentation

2e739ed

dmbaturin approved these changes Nov 24, 2025

View reviewed changes

scj643 force-pushed the ssh-fido2-options branch from d2023f1 to 26bf287 Compare November 24, 2025 17:41

smoketest: T7483: Add fido ssh smoketest

bddeabc

scj643 force-pushed the ssh-fido2-options branch from 26bf287 to bddeabc Compare November 24, 2025 17:45

sever-sever requested changes Nov 25, 2025

View reviewed changes

sever-sever approved these changes Nov 28, 2025

View reviewed changes

ssh: T7483: Add fido2 PubkeyAuthOptions #4852

Are you sure you want to change the base?

ssh: T7483: Add fido2 PubkeyAuthOptions #4852

Conversation

scj643 commented Nov 17, 2025 • edited by c-po Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change summary

Types of changes

Related PRs

Related Task(s)

How to test / Smoketest result

Checklist:

Uh oh!

github-actions bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dmbaturin left a comment

Choose a reason for hiding this comment

Uh oh!

c-po left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

scj643 commented Nov 20, 2025

Uh oh!

scj643 commented Nov 20, 2025

Uh oh!

c-po commented Nov 20, 2025

Uh oh!

scj643 commented Nov 24, 2025

Uh oh!

dmbaturin left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 24, 2025

Details

Uh oh!

sever-sever left a comment

Choose a reason for hiding this comment

Uh oh!

scj643 commented Nov 25, 2025

Uh oh!

scj643 commented Nov 27, 2025

Uh oh!

sever-sever left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

scj643 commented Nov 17, 2025 •

edited by c-po

Loading

github-actions bot commented Nov 17, 2025 •

edited

Loading

c-po left a comment •

edited

Loading