I spent a fair amount of time reading articles by both Yubikey and others that attempted to explain this process but I always hit a roadblock. I finally found an excellent article by Luiz Costa¹ that worked perfectly.

I am referencing Luiz’s article here as both a reminder for myself and to drive further traffic to it as it does an excellent job explaining this process, especially when using GNOME as it details how to get past GNOME keyring getting in the way.

You should definitely check out the full article linked below¹, but here is a TLDR of the commands for quick reference.

Key Generation and Usage Commands#

The following assumes you have already used Yubikey Authenticator² or Yubikey Manager³ (deprecated) to setup a FIDO2 PIN on your key.

# Generate SSH key on Yubikey
ssh-keygen -t ed25519-sk -O resident -O verify-required -O application=ssh:resourcenamehere -C "key-comment-here"
# Copy public key generated above to the server you wish to authenticate to
# Use the following command to ssh to a server using the new key, or edit ~/.ssh/config (see below)
SSH_AUTH_SOCK="" ssh -i .ssh/id_ed25519 -o IdentitiesOnly=yes user@example.com
# To use the Yubikey on another computer, import the resident key file on the new computer (insert the Yubikey and run the below command)
ssh-keygen -K

You can also put something like the following in ~/.ssh/config so you do not have to type the SSH_AUTH_SOCK or specify a key file:

Host github.com
     IdentityFile ~/.ssh/id_ed25519_sk_yubikey
     IdentitiesOnly yes
     IdentityAgent none
     Port 22

Do you have other suggestions to improve this article? Let me know .

References#