Feature/add yubikey #316

j0hnsmith · 2018-11-29T08:55:59Z

Adds Yubikey integration, #230.

j0hnsmith · 2018-11-29T10:38:58Z

The build is failing because libpcsclite is now required, I'm not sure if/how I can modify the build env (happy to try if someone can guide me). Pretty sure that's not the only new package needed.

ismailyenigul · 2018-12-04T12:21:53Z

Great job!
I look forward to this feature. I can be first beta tester :)

Isaacpm · 2019-01-16T10:53:10Z

Hi, is there any update on this PR? It would be very useful to have.

j0hnsmith · 2019-01-16T12:09:18Z

If you don't want to wait for this PR to be merged you can build it yourself, see https://github.com/99designs/aws-vault#development (that's what I've done, works well for me, I use it most days). If you do please report here with your experience of the functionality as it will add impetus to this PR.

Isaacpm · 2019-01-16T12:10:51Z

I will give that a try, and report here, thanks!

p0bailey · 2019-01-30T16:57:26Z

Hello there,

Great work! Any updates on when this pr would be merged into master ?

I'm having problems to build the code from https://github.com/j0hnsmith/aws-vault

I clone this repo https://github.com/j0hnsmith/aws-vault
I switch to feature/add_yubikey
I run: go build and I get.

./main.go:27:22: cannot use app (type *"gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureGlobals
./main.go:28:25: cannot use app (type *"gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureAddCommand
./main.go:29:26: cannot use app (type *"gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureListCommand
./main.go:30:28: cannot use app (type *"gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureRotateCommand

phillip

j0hnsmith · 2019-01-31T12:18:58Z

@p0bailey Something like this should work

cd ${GOPATH}/src/github.com
git clone git@github.com:99designs/aws-vault.git
git remote add git@github.com:j0hnsmith/aws-vault.git
git fetch j0hnsmith feature/add_yubikey
git checkout j0hnsmith/feature/add_yubikey

make build
# now you need to sign and install, see https://github.com/99designs/aws-vault#self-signing-your-binary

StevenACoffman · 2019-02-14T19:48:20Z

I found the code signing directions lacking.

Deal with signing aws-vault

Start keychain access
Keychain access -> Certificate assistance -> Create a certificate
Name it whatever you like (I choose AWSVAULTSIGNER)
Check "Let me override defaults"
Just click continue until you reach "Extended Key Usage Extension" select "Code Signing"
Just click continue until you reach the point to select Keychain, select the System keychain
type codesign --force --sign name-of-certificate /Users/${HOME}/go/src/github.com/99designs/aws-vault/aws-vault in your console
You can then sign your binary like this:

go get -u -v github.com/99designs/aws-vault
cd $GOPATH/src/github.com/99designs/aws-vault
make build
codesign --force --sign name-of-certificate ${GOPATH}/src/github.com/99designs/aws-vault/aws-vault
export PATH="$(PWD):$PATH"
# verify signature
codesign -dvv $(which aws-vault) 2>&1 | grep Authority

Verify signature

$ codesign -dvv $(which aws-vault) 2>&1 | grep Authority

Check out Apple's guide on it here, or find it in Keychain Access > Certificate Assistant > Create Certificate > Code Signing Certificate.

viraptor · 2019-03-07T00:34:12Z

@j0hnsmith I'm getting the same issue. After switching to your branch:

➜  aws-vault git:(270eaf0) make build
go build -o aws-vault -ldflags="-X main.Version=v4.4.1-23-g270eaf0 -s -w" .
main.go:6:2: cannot find package "github.com/99designs/aws-vault/cli" in any of:
	/Users/viraptor/go/src/github.com/aws-vault/vendor/github.com/99designs/aws-vault/cli (vendor tree)
	/usr/local/Cellar/go/1.12/libexec/src/github.com/99designs/aws-vault/cli (from $GOROOT)
	/Users/viraptor/go/src/github.com/99designs/aws-vault/cli (from $GOPATH)
make: *** [build] Error 1

➜  aws-vault git:(270eaf0) go get
# github.com/aws-vault
./main.go:27:22: cannot use app (type *"github.com/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureGlobals
./main.go:28:25: cannot use app (type *"github.com/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureAddCommand
./main.go:29:26: cannot use app (type *"github.com/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureListCommand
./main.go:30:28: cannot use app (type *"github.com/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureRotateCommand
./main.go:31:26: cannot use app (type *"github.com/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureExecCommand
./main.go:32:28: cannot use app (type *"github.com/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureRemoveCommand
./main.go:33:27: cannot use app (type *"github.com/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureLoginCommand
./main.go:34:28: cannot use app (type *"github.com/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application) as type *"github.com/99designs/aws-vault/vendor/gopkg.in/alecthomas/kingpin.v2".Application in argument to cli.ConfigureServerCommand
./main.go:35:2: undefined: cli.ConfigureAddYubikeyCommand
./main.go:36:2: undefined: cli.ConfigureRemoveYubikeyCommand
./main.go:36:2: too many errors

That's using go1.12 on a mac

j0hnsmith · 2019-03-07T08:51:16Z

@viraptor if you follow the instructions in #316 (comment) all should be good.

j0hnsmith · 2019-03-07T08:52:48Z

@mtibben are you happy with the general premise of this PR? If so, what needs to happen to get the build to pass?

viraptor · 2019-03-07T09:10:26Z

@j0hnsmith That's what I did, with some fixes:

cd ${GOPATH}/src/github.com
git clone git@github.com:99designs/aws-vault.git
cd aws-vault
git remote add j0hnsmith git@github.com:j0hnsmith/aws-vault.git
git fetch j0hnsmith feature/add_yubikey
git checkout j0hnsmith/feature/add_yubikey
make build

But there is some reproducible issue it seems.

mtibben · 2019-03-08T04:04:48Z

@j0hnsmith FYI I've just rebased this

j0hnsmith · 2019-03-08T07:51:15Z

@viraptor I've just built and installed the rebased version using 1.11.5, worked ok for me, you could try that.

viraptor · 2019-03-08T08:26:11Z

Found the problem - missing directory in the structure - fixed here:

mkdir -p ${GOPATH}/src/github.com/99designs
cd ${GOPATH}/src/github.com/99designs
git clone git@github.com:99designs/aws-vault.git
cd aws-vault
git remote add j0hnsmith git@github.com:j0hnsmith/aws-vault.git
git fetch j0hnsmith feature/add_yubikey
git checkout j0hnsmith/feature/add_yubikey
make build

davxiao · 2019-03-21T21:20:20Z

Is this already merged to the latest release or it will be included?

jottr · 2019-03-28T10:39:57Z

libpcsclite seems to be missing. Could someone please update the dependencies and merge this?
Lots of people are waiting for this. :)

jottr · 2019-03-28T11:44:46Z

@j0hnsmith I've built and tried using the yubikey with aws-vault, but couldn't get it to work:

I've added the ARN of the yubikey, to ~/.aws/config with mfa_serial as the key.
I am prompted for a token for the correct mfa ARN when I run aws-vault exec yubiawsaccount -- aws, but pressing the button on the key does nothing.
Not sure what I'm missing

Also, it is quite unclear what aws-vault add-yubikey actually adds the key to. Would this be to the AWS account itself?

jottr · 2019-04-05T08:58:03Z

@lox @j0hnsmith can this PR please be expedited?
Having U2F support in aws-vault should be considered to be on of the most important features of a tool that facilitates authentication against sensitive server infrastructure.

lox · 2019-05-20T22:05:50Z

What's the status of this @j0hnsmith? I'm reviewing PR's presently, is this ready for review?

j0hnsmith · 2019-05-21T07:03:19Z

@lox I've just rebased against master so yes, absolutely.

The build is failing because libpcsclite needs to be available in the travis environment to build, pretty sure that's not the only missing package. I don't know how to add it, if you can guide me I'm happy to do it, alternatively if you know what needs to be done I'm happy for you to do it.

lox · 2019-05-22T02:28:18Z

Ok cool. I'll see if I can figure out how to get libpcsclite installed and I'll leave some notes throughout the PR.

asiragusa · 2019-05-27T09:31:10Z

@j0hnsmith great job! I have tested your PR and I found a flaw in ykoath (yawn/ykoath#8) if you stored tokens that require the --touch and tokens that don't, in some cases this PR won't work.

I did not have a reply for 10 days, but it would be nice if this PR would work properly. Can you update the commit ID in go.mod?

Also, I found a small quirk with the MFA device being added even if the tokens used are wrong, in this case you might try to do some cleanup. It's not a major issue, as manually doing aws-vault remove-yubikey fixes the problem.

asiragusa · 2019-05-27T14:43:54Z

@j0hnsmith it would be nice also if we could have more feedback once the Yubikey button has been pressed. Today it shows:

waiting for yubikey touch...

And nothing more once you pressed it. For tasks that don't output something for seconds it's impossible to know if you have correctly pressed the button or not. If you touch the button multiple times, the console is filled with random chars, otherwise it timeouts and asks for a token.

A simple OK\n aligned with the waiting for yubikey touch... would make it

j0hnsmith · 2019-06-03T07:02:39Z

@asiragusa Thanks for testing and giving feedback. I've added OK\n once touch has happened.

I found a small quirk with the MFA device being added even if the tokens used are wrong

In what situation would the token be wrong?

Can you update the commit ID in go.mod?

What do you want it updated to, surely your PR has to be merged first?

asiragusa · 2019-06-03T10:25:23Z

@asiragusa Thanks for testing and giving feedback. I've added OK\n once touch has happened.

Great, thanks!

I found a small quirk with the MFA device being added even if the tokens used are wrong

In what situation would the token be wrong?
It happens if you already have both tokens with and without touch requirement in your Yubikey, so it's mainly an edge case.

Can you update the commit ID in go.mod?

What do you want it updated to, surely your PR has to be merged first?

Given that it's an edge case we can merge this PR and wait for yawn/ykoath#8 to be merged. An issue to remind to update the go.mod will do the trick ;)

asiragusa · 2019-06-12T13:02:43Z

@j0hnsmith I have found a small issue using the remove-yubikey command.

In my environment I have forbidden to remove MFA devices without using a MFA token and probably the remove-yubikey command doesn't generate one for the operation.

The output I have is the following:

$ aws-vault remove-yubikey xxx yyy
Removing yubikey for user xxx using profile yyy)
aws-vault: error: error removing yubikey
%!(EXTRA *errors.withStack=failed to delete virtual AWS MFA device with serial "arn:aws:iam::zzz:mfa/xxx": AccessDenied: User: arn:aws:iam::zzz:user/xxx is not authorized to perform: iam:DeleteVirtualMFADevice on resource: arn:aws:iam::zzz:mfa/xxx
	status code: 403, request id: req-id)

This reverts commit 80a54ed.

don't delete from the yubikey until the mfa device has been deactivated and deleted from aws

j0hnsmith · 2019-06-24T07:44:54Z

@asiragusa I've found and fixed the problem with removing a yubikey, the creds used are obtained with a TOTP. This is the policy I tested with (deny is better than allow as an explicit deny will deny regardless of other policies)

      {
         "Effect":"Deny",
         "Action":[
            "iam:DeactivateMFADevice",
            "iam:DeleteVirtualMFADevice"
         ],
         "Resource":"arn:aws:iam::${account_id}:mfa/$${aws:username}",
         "Condition":{
            "NumericGreaterThan":{
               "aws:MultiFactorAuthAge":"900"
            }
         }
      },

I commented out the Condition and was unable to remove the yubikey, got the expected error, then after uncommenting and applying the change I was able to remove the yubikey.

j0hnsmith · 2019-06-24T07:45:16Z

@mtibben rebased

mtibben · 2019-06-25T00:43:39Z

Awesome, thank you so much @j0hnsmith for this feature!

arnuschky · 2019-06-28T09:41:31Z

I am struggling with using Yubikey-based auth too. I built aws-vault just fine, following the instructions above (thanks!)

However, when I add the Yubikey to my account through the AWS console and set the MFA's arn in my ~/.aws/config, I end up with the following:

Enter token for arn:aws:iam::xxxx:u2f/user/myuser/default-zzzz: cccckkahgsdfhasdlkfhaskdjf
aws-vault: error: Failed to get credentials for xxx (source profile for xxx-yyy): ValidationError: 2 validation errors detected: Value 'cccckkahgsdfhasdlkfhaskdjf' at 'tokenCode' failed to satisfy constraint: Member must satisfy regular expression pattern: [\d]*; Value 'cccckkahgsdfhasdlkfhaskdjf' at 'tokenCode' failed to satisfy constraint: Member must have length less than or equal to 6

However, if I remove the yubikey from by account via the AWS ui and try to add it through aws-vault, I get the following:

aws-vault add-yubikey myuser xxx-yyy
Adding yubikey to user myuser using profile xxx-yyy
aws-vault: error: error registering yubikey
%!(EXTRA *errors.withStack=error creating virtual device: EntityAlreadyExists: MFADevice entity at the same path and name already exists.

I am a bit lost here. What is add-yubikey for actually? How can I use the yubikey? Why doesn't aws-vault accept my token?

j0hnsmith · 2019-06-28T10:22:48Z

@arnuschky aws-vault add-yubikey registers your yubikey as a TOTP device (not U2F) for the given username with AWS. Then when you aws-vault exec ... or similar it gets a 6 digit TOTP from the yubikey and uses it to create your AWS session. A token that looks like cccckkahgsdf.... is a U2F token, not TOTP which is 6 numbers (as you'd get from Google Authenticator or similar).

As long as you can see an entry in Yubikey Authenticator (don't ever manually remove that), I think you need to

if you've added a u2f mfa device via the interface, remove it via the interface
ensure you have something like this in you ~/.aws/config

[profile name-used-in-aws-vault]
mfa_serial=arn:aws:iam::{your account number}:mfa/{your username}

run aws-vault remove-yubikey --debug profilename username (you can run more than once if necessary, aws seems to keep mfa devices for deleted users)
now you should have a clean state, so can run aws-vault add-yubikey --debug myuser xxx-yyy (the debug should provide a little extra info)
aws-vault exec profilename -- aws iam list-mfa-devices --user-name your_username or other command that requires mfa auth

tlwr · 2019-07-03T17:55:12Z

This is a super neat feature, thanks very much @j0hnsmith, and @mtibben for merging!

Sorry if I'm being impatient. Is there an ETA for a GH release of this? There are a number of aws-vault users in our org who would benefit from this feature.

Thanks again

mtibben · 2019-07-04T23:50:18Z

@j0hnsmith I've just run into some problems trying to create a new release of aws-vault due to the introduction of CGO and cross-compilation. I'm going to revert this from master and look to address in a new PR

mtibben force-pushed the feature/add_yubikey branch from 270eaf0 to da89887 Compare March 8, 2019 04:03

mtibben requested a review from lox March 8, 2019 04:04

j0hnsmith force-pushed the feature/add_yubikey branch from da89887 to 59f3ee6 Compare May 21, 2019 07:01

j0hnsmith and others added 17 commits June 24, 2019 08:19

add comment

70641f0

deps

3baea25

clean up wrap/wrapf calls

0c5ccc5

full size qr code, half blocks doesn't work well

8e5f711

fix message

1336381

indicate that touch happened

e23213d

Add libpcsclite-dev using apt

ec6b95c

whitespace

328d7b4

doesn't need to be exported

b1f053b

Revert "doesn't need to be exported"

33ddcd8

This reverts commit 80a54ed.

doesn't need to be exported

1dd6308

improve error handling

8d752f6

delete from yubikey only after removing from aws

fb882e1

don't delete from the yubikey until the mfa device has been deactivated and deleted from aws

use creds from vault, using a TOTP if necessary

2534927

delete cached session as authed with removed yubikey

8ffb026

update readme

49f156e

deps

fbbc139

j0hnsmith force-pushed the feature/add_yubikey branch from aed9720 to fbbc139 Compare June 24, 2019 07:44

mtibben merged commit 39f7a6b into 99designs:master Jun 25, 2019

mtibben mentioned this pull request Jun 25, 2019

Yubikey Integration #230

Closed

mtibben added a commit that referenced this pull request Jul 4, 2019

Add support for Yubikey (#316)

93849e9

mtibben mentioned this pull request Jul 5, 2019

Add support for Yubikey #392

Closed

mtibben mentioned this pull request Apr 20, 2020

Yubikey support #558

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/add yubikey #316

Feature/add yubikey #316

j0hnsmith commented Nov 29, 2018

j0hnsmith commented Nov 29, 2018

ismailyenigul commented Dec 4, 2018

Isaacpm commented Jan 16, 2019

j0hnsmith commented Jan 16, 2019

Isaacpm commented Jan 16, 2019

p0bailey commented Jan 30, 2019 •

edited

j0hnsmith commented Jan 31, 2019 •

edited

StevenACoffman commented Feb 14, 2019

viraptor commented Mar 7, 2019

j0hnsmith commented Mar 7, 2019

j0hnsmith commented Mar 7, 2019

viraptor commented Mar 7, 2019

mtibben commented Mar 8, 2019

j0hnsmith commented Mar 8, 2019

viraptor commented Mar 8, 2019

davxiao commented Mar 21, 2019

jottr commented Mar 28, 2019

jottr commented Mar 28, 2019 •

edited

jottr commented Apr 5, 2019 •

edited

lox commented May 20, 2019

j0hnsmith commented May 21, 2019

lox commented May 22, 2019

asiragusa commented May 27, 2019

asiragusa commented May 27, 2019

j0hnsmith commented Jun 3, 2019

asiragusa commented Jun 3, 2019 •

edited

asiragusa commented Jun 12, 2019

j0hnsmith commented Jun 24, 2019 •

edited

j0hnsmith commented Jun 24, 2019

mtibben commented Jun 25, 2019

arnuschky commented Jun 28, 2019 •

edited

j0hnsmith commented Jun 28, 2019 •

edited

tlwr commented Jul 3, 2019

mtibben commented Jul 4, 2019

Feature/add yubikey #316

Feature/add yubikey #316

Conversation

j0hnsmith commented Nov 29, 2018

j0hnsmith commented Nov 29, 2018

ismailyenigul commented Dec 4, 2018

Isaacpm commented Jan 16, 2019

j0hnsmith commented Jan 16, 2019

Isaacpm commented Jan 16, 2019

p0bailey commented Jan 30, 2019 • edited

j0hnsmith commented Jan 31, 2019 • edited

StevenACoffman commented Feb 14, 2019

Deal with signing aws-vault

Verify signature

viraptor commented Mar 7, 2019

j0hnsmith commented Mar 7, 2019

j0hnsmith commented Mar 7, 2019

viraptor commented Mar 7, 2019

mtibben commented Mar 8, 2019

j0hnsmith commented Mar 8, 2019

viraptor commented Mar 8, 2019

davxiao commented Mar 21, 2019

jottr commented Mar 28, 2019

jottr commented Mar 28, 2019 • edited

jottr commented Apr 5, 2019 • edited

lox commented May 20, 2019

j0hnsmith commented May 21, 2019

lox commented May 22, 2019

asiragusa commented May 27, 2019

asiragusa commented May 27, 2019

j0hnsmith commented Jun 3, 2019

asiragusa commented Jun 3, 2019 • edited

asiragusa commented Jun 12, 2019

j0hnsmith commented Jun 24, 2019 • edited

j0hnsmith commented Jun 24, 2019

mtibben commented Jun 25, 2019

arnuschky commented Jun 28, 2019 • edited

j0hnsmith commented Jun 28, 2019 • edited

tlwr commented Jul 3, 2019

mtibben commented Jul 4, 2019

p0bailey commented Jan 30, 2019 •

edited

j0hnsmith commented Jan 31, 2019 •

edited

jottr commented Mar 28, 2019 •

edited

jottr commented Apr 5, 2019 •

edited

asiragusa commented Jun 3, 2019 •

edited

j0hnsmith commented Jun 24, 2019 •

edited

arnuschky commented Jun 28, 2019 •

edited

j0hnsmith commented Jun 28, 2019 •

edited