Yubikey to secure servers.. has anyone tried it?

[humptydumpty]

@BrutalBirdie Thank @fbartels . We owe him a beer now.

[humptydumpty]

@fbartels said in Yubikey to secure servers.. has anyone tried it?:

I wanted to upgrade to a stick that supports fido 2.0 for quite a while

I hear you. I looked into Yubikeys many times but the cost ramped up quickly since it's best if you have a backup key and with a handful of family members, the bill wasn't easy to swallow. This deal makes it possible. I wish they made a nano NFC version though. I could have it hidden inside a custom made wearable like a pendant, bracelet, or even toss it inside a watch.

[jdaviescoates]

@humptydumpty said in Yubikey to secure servers.. has anyone tried it?:

@jdaviescoates It seems you need to have an active zone or use zero trust.

thanks for the heads up, I guess I had better set something up then... hopefully I'm not too late (probably should've read that and done it before clicking on the claim offer button!)

[timconsidine]

@humptydumpty do I understand correctly that in order to use Cloudflare on a domain, they have to be registrar for it, i.e. transfer the domain to them?

I am my own Nominet registrar, so if the above is true, I cannot use Cloudflare on domains currently with Nominet.

EDIT : should have looked a bit further.
They don't support registering .UK domains so the above cannot be true.
Doh !
Ignore me.

[robi]

@timconsidine Yes

They started fronting/protecting domains before they became a registrar which is very recent.

[BrutalBirdie]

@humptydumpty said in Yubikey to secure servers.. has anyone tried it?:

We owe him a beer now.

If the yubico e-mail ever arrives I will sponsor a beer.

[BrutalBirdie]

@timconsidine said in Yubikey to secure servers.. has anyone tried it?:

do I understand correctly that in order to use Cloudflare on a domain, they have to be registrar for it, i.e. transfer the domain to them?

No, you can also delegate single zones or the whole domain to another name server.
For example I have some domains registered at autodns, which cloudron does not have an auto config for.
So I can delegate either the whole domain or a zone to another name server.

Example:

I have my AwesomeDomain.tld and I want to have a cloudron on my.dev.AwesomeDomain.tld and want the .*.dev zone to be managed by DigitalOcean.
I can set 3x NS records for dev with ns[1-3].digitalocean.com. as value.

Now the zone is delegated to DigitalOcean DNS Servers and can be managed over there.

Watch out tho! When configuring Cloudron you have to click Advanced settings for the DNS setup and set the Zone Name (Optional) to dev.AwesomeDomain.tld which would be by default AwesomeDomain.tld

[timconsidine]

@BrutalBirdie thank you !
For some reason I struggle with Cloudflare.
Must try harder - I'm sure it's within my grasp

[BrutalBirdie]

@timconsidine if you need some help, let me know. I am happy to help.

[humptydumpty]

@timconsidine No, I still have my domains at their respective registrars. You just edit the nameservers to cloudflare and you're set.

Cloudflare Nameservers
To use Cloudflare, ensure your authoritative DNS servers, or nameservers have been changed. These are your assigned Cloudflare nameservers.
Type	Value
NS	sunny.ns.cloudflare.com
NS	terin.ns.cloudflare.com

BTW, renewal prices have gone up. The .com was $8.57 and it has gone up to $9.15. Namesilo sent an email back in aug-sep(?) about the price increase so it must be ICANN mandated.

[timconsidine]

@humptydumpty thank you

I use my Nominet account for *.UK and dynadot for all else.
Dynadot seem similar prices.

[fbartels]

@timconsidine i recently documented the steps in a little blog post. https://blog.9wd.eu/posts/9wd-tech-external-services/

[timconsidine]

@fbartels thank you !

[humptydumpty]

@jdaviescoates during the mess of figuring out how to get to that offer button, I created a new account and signed up for the offer just like you did. I received an email yesterday with the "decline" and telling me how to become eligible. The sad part is that I haven't received the coupon on my eligible account yet.

[humptydumpty]

Update: I received my coupon email earlier today.

The email came from (add it to your whitelist):

resources {{a.t.}} info [.d.0.t.] yubico [.d.0.t.] com

Congratulations! You are one step closer to activating phishing-resistant MFA with industry leading Yubico security keys at an exclusive 'good for the Internet' price.

Even better news! For a limited time, we're excited to surprise you with an upgrade to our multi-protocol YubiKey 5 Series!

You are now eligible to purchase up to 4 individual YubiKey 5 NFC or YubiKey 5C NFC (minimum 2) starting as low as $10 USD.  

Ready to get started with the YubiKey?
Here is your single-use coupon for up to four (4) YubiKey 5 NFC or YubiKey 5C NFC (minimum 2) keys for as low as $10 USD or €10 Euros at www.yubico.com

But there is more…. 

Looking to purchase more YubiKeys? YubiEnterprise Subscription provides flexible purchasing options of YubiKeys, predictable spend, premium support and a lower cost to entry.

Cloudflare customers with 500 or more users are eligible to receive an exclusive 50% discount off their first year of YubiEnterprise Subscription.

[BrutalBirdie]

I got my for Yubikeys today.

[humptydumpty]

@BrutalBirdie Nice! I got mine yesterday (a day ahead of estimated delivery). I just got around to setting mine up. Vaultwarden (webauthn method) works great. I tried to secure my laptop login (W11 Home on a local account) but it's still logging me in without the Yubikey. The drive isn't encrypted so that might have something to do with it. I read that Bitlocker is only available on the Pro version, not Home. I can use Drive Encryption instead but it's asking to log into a Microsoft account. It's days like these when I curse the devs of my work related software for not supporting Linux!

[humptydumpty]

How are you all carrying your Yubikey around?

[fbartels]

@humptydumpty i'm just carrying mine on my keychain. They are very robust. No problems so far with my 9+ years old key.

[BrutalBirdie]

Here is my workflow with yubikeys (from now on short yk).

I have three.

• 1x Mobile
• 1x Stationary
• 1x Backup

If a webpage offers FIDO support, great! But? Only 1 key? The site must have multi key support. Good examples are Github, Hetzner and may more.
A BAD Example is kraken.com! A Crypto trading platform which only supports ONE KEY!
I had a lengthy discussion with one of the support head members who promised me, multi keys will be available soon. The all known SOON.

If not, I use the TOTP feature from the yk.

This way I can always sync mobile and stationary and every quarter of the year I get my backup key from the bank vault and sync it as well.

This way I always a duo setup and 1x spare in case of absolute disaster.

I've been running this setup for quite some time and the vault key can be a bit annoying, but security over comfort.