0xWheatyz
7c25228bc5
Set actual GPG key ID for git commit signing, disable GCR ssh-agent socket so gpg-agent handles SSH auth, and trim redundant setup steps from yubikey guide.
248 lines
4.4 KiB
Markdown
248 lines
4.4 KiB
Markdown
# Post-Rebuild YubiKey Setup Guide
|
|
|
|
## Step 1: Generate GPG Master Key
|
|
|
|
```bash
|
|
gpg --expert --full-generate-key
|
|
```
|
|
|
|
At the prompts:
|
|
|
|
1. Select **(9) ECC and ECC**
|
|
2. Curve: **Curve 25519**
|
|
3. Expiration: **1y**
|
|
4. Real name: **0xWheatyz**
|
|
5. Email: **wyatt@leeworks.dev**
|
|
6. Set a strong passphrase
|
|
|
|
Note the key ID printed (e.g. `0x1234ABCD5678EFGH`).
|
|
|
|
---
|
|
|
|
## Step 2: Add Subkeys
|
|
|
|
```bash
|
|
gpg --expert --edit-key <KEY-ID>
|
|
```
|
|
|
|
Add 3 subkeys at the `gpg>` prompt:
|
|
|
|
**Signing subkey:**
|
|
|
|
```
|
|
gpg> addkey
|
|
→ (10) ECC (sign only)
|
|
→ Curve 25519
|
|
→ 1y expiry
|
|
```
|
|
|
|
**Encryption subkey** (may already exist — check with `list`):
|
|
|
|
```
|
|
gpg> addkey
|
|
→ (12) ECC (encrypt only)
|
|
→ Curve 25519
|
|
→ 1y expiry
|
|
```
|
|
|
|
**Authentication subkey:**
|
|
|
|
```
|
|
gpg> addkey
|
|
→ (11) ECC (set your own capabilities)
|
|
→ Toggle: disable Sign, enable Authenticate
|
|
→ Curve 25519
|
|
→ 1y expiry
|
|
```
|
|
|
|
```
|
|
gpg> save
|
|
```
|
|
|
|
---
|
|
|
|
## Step 3: Back Up Master Key (CRITICAL)
|
|
|
|
> Once keys are moved to the YubiKey, they cannot be extracted. Back up now.
|
|
|
|
```bash
|
|
mkdir -p /tmp/gpg-backup
|
|
gpg --armor --export-secret-keys <KEY-ID> > /tmp/gpg-backup/master-secret.asc
|
|
gpg --armor --export-secret-subkeys <KEY-ID> > /tmp/gpg-backup/subkeys-secret.asc
|
|
gpg --armor --export <KEY-ID> > /tmp/gpg-backup/public.asc
|
|
gpg --export-ownertrust > /tmp/gpg-backup/ownertrust.txt
|
|
```
|
|
|
|
Copy `/tmp/gpg-backup/` to an encrypted USB drive or other secure offline storage. Then remove the temp copy:
|
|
|
|
```bash
|
|
rm -rf /tmp/gpg-backup
|
|
```
|
|
|
|
---
|
|
|
|
## Step 4: Move Subkeys to YubiKey
|
|
|
|
```bash
|
|
gpg --edit-key <KEY-ID>
|
|
```
|
|
|
|
Move each subkey to its corresponding card slot:
|
|
|
|
```
|
|
gpg> key 1
|
|
gpg> keytocard
|
|
→ (1) Signature key
|
|
gpg> key 1
|
|
|
|
gpg> key 2
|
|
gpg> keytocard
|
|
→ (2) Encryption key
|
|
gpg> key 2
|
|
|
|
gpg> key 3
|
|
gpg> keytocard
|
|
→ (3) Authentication key
|
|
|
|
gpg> save
|
|
```
|
|
|
|
---
|
|
|
|
## Step 5: Set Trust & Verify
|
|
|
|
```bash
|
|
gpg --edit-key <KEY-ID>
|
|
```
|
|
|
|
```
|
|
gpg> trust
|
|
→ (5) I trust ultimately
|
|
gpg> quit
|
|
```
|
|
|
|
Verify the card:
|
|
|
|
```bash
|
|
gpg --card-status # Should show all 3 subkeys
|
|
gpg --list-secret-keys # Subkeys should show "ssb>" (stub pointing to card)
|
|
```
|
|
|
|
---
|
|
|
|
## Step 6: Back Up & Remove Old SSH Keys
|
|
|
|
```bash
|
|
mkdir -p ~/.ssh/old
|
|
mv ~/.ssh/id_ed25519 ~/.ssh/old/
|
|
mv ~/.ssh/id_ed25519.pub ~/.ssh/old/
|
|
```
|
|
|
|
---
|
|
|
|
## Step 7: Get Your New SSH Public Key
|
|
|
|
```bash
|
|
gpg --export-ssh-key <KEY-ID>
|
|
```
|
|
|
|
This outputs the SSH public key derived from your GPG auth subkey. Save it:
|
|
|
|
```bash
|
|
gpg --export-ssh-key <KEY-ID> > ~/.ssh/yubikey.pub
|
|
```
|
|
|
|
Verify gpg-agent serves it:
|
|
|
|
```bash
|
|
ssh-add -L # Should show the same key
|
|
```
|
|
|
|
Deploy this key to your remote servers:
|
|
|
|
- **vps** (45.79.198.105) — add to `~/.ssh/authorized_keys` for user `wyatt`
|
|
- **home** (10.0.0.20) — add to `~/.ssh/authorized_keys` for user `l-wyatt`
|
|
- **git** (10.0.1.10) — add via your Gitea/Forgejo web UI
|
|
- **GitHub** — Settings → SSH and GPG Keys → New SSH Key
|
|
|
|
> **Tip:** Use the old key (still in `~/.ssh/old/`) to SSH in and deploy the new one:
|
|
> ```bash
|
|
> ssh -i ~/.ssh/old/id_ed25519 vps "echo '$(gpg --export-ssh-key <KEY-ID>)' >> ~/.ssh/authorized_keys"
|
|
> ```
|
|
|
|
---
|
|
|
|
## Step 8: Update home.nix with Your Signing Key
|
|
|
|
Get your key ID:
|
|
|
|
```bash
|
|
gpg --list-secret-keys --keyid-format 0xlong
|
|
```
|
|
|
|
Then edit `home.nix` and replace the `key = null;` line:
|
|
|
|
```nix
|
|
signing = {
|
|
key = "<YOUR-0xLONG-KEY-ID>"; # e.g. "0x1234ABCD5678EFGH"
|
|
signByDefault = true;
|
|
};
|
|
```
|
|
|
|
Rebuild again:
|
|
|
|
```bash
|
|
nixos-rebuild switch
|
|
```
|
|
|
|
---
|
|
|
|
## Step 9: Verify Everything
|
|
|
|
```bash
|
|
# Smartcard
|
|
gpg --card-status
|
|
|
|
# SSH via YubiKey
|
|
ssh-add -L
|
|
ssh vps echo "YubiKey SSH works!"
|
|
|
|
# Git signing
|
|
cd /tmp && git init test-sign && cd test-sign
|
|
git commit --allow-empty -m "test signing"
|
|
git log --show-signature -1
|
|
# Should show "Good signature from 0xWheatyz <wyatt@leeworks.dev>"
|
|
rm -rf /tmp/test-sign
|
|
```
|
|
|
|
---
|
|
|
|
## Step 10 (Optional): Change YubiKey PINs
|
|
|
|
The default PINs are `123456` (user) and `12345678` (admin). Change them:
|
|
|
|
```
|
|
gpg --card-edit
|
|
gpg/card> admin
|
|
gpg/card> passwd
|
|
→ (1) Change PIN
|
|
→ (3) Change Admin PIN
|
|
gpg/card> quit
|
|
```
|
|
|
|
---
|
|
|
|
## Step 11 (Optional): Upload GPG Public Key to GitHub
|
|
|
|
```bash
|
|
gpg --armor --export <KEY-ID>
|
|
```
|
|
|
|
Paste the output into **GitHub → Settings → SSH and GPG Keys → New GPG Key**. This makes your signed commits show "Verified" on GitHub.
|
|
|
|
---
|
|
|
|
## Note
|
|
|
|
The config changes to `configuration.nix` and `home.nix` are already saved. After you rebuild, reboot, and follow the steps above, you'll need to come back to update `home.nix` one more time with your actual GPG key ID (Step 8) and do a final rebuild.
|