I can setup SSH keypair without Fido U2F as described SSH-agent working over many servers without retyping? Some flag? in the thread. Two step verification would be very good: password for the private key and Fido U2F verification too. I am not sure if we need here Fido/YubiKey server too, as instructed in the thread Yubico Linux Login. My motivation is that I forget so often my passwords which are very long if used in 1-step verifications. 1-step verification is also weak itself although how long and difficult the password is. Therefore, I would like to have 2-step verification in my Debian with keys, because I think keys can improve much security.
Ticket sent to YubiKey team 22nd Feb 2017
Dear Sir/Madam, We are thinking how to get 2-step verification with your key and keys in the following thread. Improvements are needed in FIDO U2F and OpenSSH parts. I am thinking how we can push the thing forward with You. Please, say what we can do because the feature request is rather blocked at the moment. Ticket in OpenSSH part: https://bugzilla.mindrot.org/show_bug.cgi?id=2319 Thread about the feature request: http://unix.stackexchange.com/q/346771/16920 Best regards, Leo
OS: Debian 8.7
Hardware: Asus Zenbook UX303UB
Tickets: #2319 (Jakuje)
Fido U2F key: YubiKey 4