Skip to content

BlinkyStitt/trezor-agent

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Using TREZOR as a hardware SSH agent

Build Status Python Versions Package Version Development Status Downloads Chat

See SatoshiLabs' blog post about this feature:

Screencast demo usage

Simple usage (single SSH session)

Demo

Advanced usage (multiple SSH sessions from a sub-shell)

Subshell

Using for GitHub SSH authentication (via trezor-git utility)

GitHub

Installation

To install dependencies on Debian/Ubuntu:

sudo apt-get install python-dev libusb-1.0-0-dev libudev-dev

Install trezor-agent (at least v0.6.6) and it's dependencies into a virtualenv:

pip install virtualenvwrapper

mkvirtualenv trezor-agent
pip install --upgrade setuptools
pip install --upgrade pip
pip install Cython "trezor>=0.6.6"

Then, install the latest trezor_agent package:

pip install -e git+https://github.com/WyseNynja/trezor-agent.git#egg=trezor_agent
mkdir -p ~/bin
ln -sfv $WORKON_HOME/trezor-agent/bin/trezorctl ~/bin/
ln -sfv $WORKON_HOME/trezor-agent/bin/trezor-agent ~/bin/

Make sure ~/bin is on your PATH.

Finally, verify that you are running the latest TREZOR firmware version (at least v1.3.4):

$ trezorctl get_features
vendor: "bitcointrezor.com"
major_version: 1
minor_version: 3
patch_version: 4
...

Public key generation

Add an environment variable to your ~/.bash_profile, ~/.zshrc, or whatever:

$ export TREZOR_SSH_IDENTITY=john@doe.bit

Run:

$ trezor-agent ssh.hostname.com -v > ${TREZOR_SSH_IDENTITY}.pub
2015-09-02 15:03:18,929 INFO         getting "ssh://${TREZOR_SSH_IDENTITY}" public key (nist256p1) from Trezor...
Use the numeric keypad to describe number positions. The layout is:
    7 8 9
    4 5 6
    1 2 3
Please enter current PIN:

2015-09-02 15:03:23,342 INFO         disconnected from Trezor

$ cat ${TREZOR_SSH_IDENTITY}.pub
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGSevcDwmT+QaZPUEWUUjTeZRBICChxMKuJ7dRpBSF8+qt+8S1GBK5Zj8Xicc8SHG/SE/EXKUL2UU3kcUzE7ADQ= ssh://${TREZOR_SSH_IDENTITY}

Append ${TREZOR_SSH_IDENTITY}.pub contents to ~/.ssh/authorized_keys configuration file at ssh.hostname.com or any other server to allow you to login using the corresponding private key signature.

Usage

Run:

/tmp $ trezor-agent ssh.hostname.com -v -c
2015-09-02 15:09:39,782 INFO         getting "ssh://${TREZOR_SSH_IDENTITY}" public key (nist256p1) from Trezor...
2015-09-02 15:09:44,430 INFO         please confirm user "roman" login to "ssh://ssh.hostname.com" using Trezor...
2015-09-02 15:09:46,152 INFO         signature status: OK
Linux lmde 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u3 (2015-08-04) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Sep  1 15:57:05 2015 from localhost
~ $

Make sure to confirm SSH signature on the Trezor device when requested.

About

Using Trezor as a hardware SSH agent

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • Python 99.8%
  • Shell 0.2%