YubiKey-Guide - Guide to using YubiKey as a SmartCard for GPG and SSH

•    

---

This is a guide to using YubiKey as a SmartCard for storing GPG encryption and signing keys. An authentication key can also be created for SSH and used with gpg-agent.

yubikey gpg gnupg ssh security gpg-agent gpg-configuration smartcard remote-access rsa-cryptography

keychain - keychain ssh-agent front-end

•    Shell

---

Official documentation for Keychain can be found on the official Keychain wiki page. Keychain helps you to manage ssh and GPG keys in a convenient and secure manner. It acts as a frontend to ssh-agent and ssh-add, but allows you to easily have one long running ssh-agent process per system, rather than the norm of one ssh-agent per login session.

OpenSSH - Keep your communication secret

•    C

---

OpenSSH encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other attacks. Additionally, OpenSSH provides secure tunneling capabilities and several authentication methods, and supports all SSH protocol versions.

ssh secure cryptography scp sshd sftp

privacyIDEA - Modular Authentication System

•    Python

---

privacyIDEA is a Two Factor Authentication System which is multi-tenency- and multi-instance-capable. Using privacyIDEA you can enhance your existing applications like local login, VPN, remote access, SSH connections, access to web sites or web portals with a second factor during authentication.

authentication two-factor-authentication 2fa otp security

GoSSHa - Go SSH agent: can execute commands at thousands of servers and upload files to them

•    Go

---

Ssh client that supports command execution and file upload on multiple servers (designed to handle thousands of parallel SSH connections). GoSSHa supports SSH authentication using private keys (encrypted keys are supported using external call to ssh-keygen) and ssh-agent, implemented using go.crypto/ssh. GoSSHa is not designed to be used directly by end users, but rather serve as a lightweight proxy between your application (GUI or CLI) and thousands of SSH connections to remote servers.

trezor-agent - Hardware-based SSH/PGP agent

•    Python

---

This project allows you to use various hardware security devices to operate GPG and SSH. Instead of keeping your key on your computer and decrypting it with a passphrase when you want to use it, the key is generated and stored on the device and never reaches your computer. Read more about the design here. You can do things like sign your emails, git commits, and software packages, manage your passwords (with pass and gopass, among others), authenticate web tunnels and file transfers, and more.

ssh gpg agent trezor keepkey ledger crypto hardware pgp gnupg

teleport - Privileged access management for elastic infrastructure.

•    Go

---

Teleport is built on top of the high-quality Golang SSH implementation and it is fully compatible with OpenSSH and can be used with sshd servers and ssh clients. Download the latest binary release, unpack the .tar.gz and run sudo ./install. This will copy Teleport binaries into /usr/local/bin.

ssh bastion firewall mfa two-factor u2f yubikey security ansible docker

ansible-ssh-hardening - This Ansible role provides numerous security-related ssh configurations, providing all-round base protection

•    Ruby

---

This role provides secure ssh-client and ssh-server configurations. It is intended to be compliant with the DevSec SSH Baseline. Warning: This role disables root-login on the target server! Please make sure you have another user with su or sudo permissions that can login into the server.

ansible ssh-configuration playbook role hardening protection ssh-server ssh-agent

awesome-ssh - :computer: A curated list of SSH resources.

•    

---

A curated list of SSH apps, libraries and resources. Inspired by the awesome list thing.

awesome ssh awesome-list list openssh devops ssh-key ssh-agent

pam-ussh - uber's ssh certificate pam module

•    Go

---

Uber's SSH certificate pam module.This is a pam module that will authenticate a user based on them having an ssh certificate in their ssh-agent signed by a specified ssh CA.

PuSSH

•    Python

---

PuSSH is Pythonic, Ubiquitous SSH, a Python wrapper/script that runs commands in parallel on clusters/ranges of linux/unix machines via SSH, ideally where SSH is configured to use Kerberos, RSA/DSA keys, or ssh-agent as to avoid password authentication.

MUltihost SSH Wrapper

•    Shell

---

Mussh is a shell script that allows you to execute a command or script over ssh on multiple hosts with one command. When possible mussh will use ssh-agent and RSA/DSA keys to minimize the need to enter your password more than once.

kr - A dev tool for SSH auth + Git commit/tag signing using a key stored in Krypton.

•    Go

---

kr enables SSH to authenticate with a key stored in a Krypton (iOS or Android) mobile app. kr runs as an SSH agent, called krd. When a Krypton private key operation is needed for authentication, krd routes this request to the paired mobile phone, where the user decides whether to allow the operation or not. The private key never leaves the phone. kr currently supports MacOS (10.10+) and Linux (Debian, RHEL, CentOS, Fedora with systemd).

rage - Simple, modern, and secure file encryption tool, using the age format

•    Rust

---

rage is a simple, modern, and secure file encryption tool, using the age format. It features small explicit keys, no config options, and UNIX-style composability.

cli encryption scrypt yubikey curve25519 secure-by-default rust-library zero-configuration unix-philosophy age-encryption encryption-tools command-line ssh pgp

SSHKeychain

•    Objective-C

---

SSHKeychain is a GUI front-end for ssh-agent and ssh-add on Mac OS X. It can store your key passphrases in the Apple keychain, automatically add and remove your keys on various triggers. It also has tunnel functionality.

pam_ssh

•    C

---

This module provides single sign-on behavior. The user types a passphrase when logging in and is allowed in if it decrypts the user's SSH private key. An ssh-agent is started and keys are added. For the entire session, the user types no more passwords.

yubiswitch - OSX status bar application to enable/disable Yubikey Nano

•    Objective-C

---

yubiswitch is an OSX status bar application to enable/disable a Yubikey Nano or Neo from Yubico. Yubico is the producer of the Yubikeys: an hardware authentication device, designed to provide an easy to use and secure compliment to the traditional username and password.

yubikey yubico osx statusbar

TinySSH - small SSH server

•    C

---

TinySSH is small SSH server using state-of-the-art cryptographic library NaCl / TweetNaCl. TinySSH offers good security on TCP and is designed for perfect security on CurveCP.

ssh ssh-server security cryptography

Open SSH for Windows CE

•    

---

SSH is a set of standards and an associated network protocol that allows establishing a secure channel between a local and a remote computer. It uses public-key cryptography to authenticate the remote computer and (optionally) to allow the remote computer to authenticate the u...

mobile ssh-wince

YubiKey Azure Authentication

•    

---

The YubiKey Azure Authentication project shows how to use the Yubico authentication service from a ASP.NET MVC 3 site hosted in Windows Azure, with SQL Azure as the backend user store, for a more secure two-factor authentication of users in the cloud.