Yubikey Notes

Install needed software

brew install yubico-piv-tool
brew install ykman

When plugging in the yubikey, you can close the keyboard setup assistant.

Yubikey setup with AWS CA

Notably, this does not include any of the Yubikey lockdown work to secure them.

Reset the Yubikey PIV (optional)
```
yubico-piv-tool -a reset
```

If you get Reset failed, are pincodes blocked?, reset via the YubiKey Manager

Make the PIV generate some things

yubico-piv-tool -a set-chuid
yubico-piv-tool -a set-ccc

Change the PIN:

yubico-piv-tool -achange-pin -P123456
Enter new pin:
Verifying - Enter new pin:
Successfully changed the pin code.

Generate a new private/public key pair. There is no need o preserve the generated files after these steps are completed.
```
yubico-piv-tool --action=generate -s 9a -o tmp.pub
```

Generate a CSR

yubico-piv-tool --action=verify --action=request --subject="/CN=brad.poulton@accenturefederal.com/C=US/ST=VA/L=Arlington/OU=XDR/O=Accenture Federal Services/" --algorithm=RSA2048 --hash=SHA256 -s 9a -i tmp.pub -o tmp.csr

Reencode the CSR

To reencode as base64:

openssl req -in tmp.csr -outform pem | base64 > tmp.csr.b64

Sign the CSR

For Template information, seehttps://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html (remember to change arn to aws-us-gov)
Validity is currently 2 years + 90 day grace period = 820 days

For the tmp.policy, See https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html

cat <<EOF > tmp.policy
{
  "Extensions": {
    "ExtendedKeyUsage": [
      { "ExtendedKeyUsageType": "CLIENT_AUTH" },
      { "ExtendedKeyUsageType": "SMART_CARD_LOGIN" }
    ],
    "SubjectAlternativeNames": [
      { "Rfc822Name": "brad.poulton@accenturefederal.com" },
      { "Rfc822Name": "brad.poulton@accenturefederalcyber.com" }
    ]
  }
}
EOF

Maybe:

    "OtherName": {
      #"TypeId": "string",
      "Value": "1.3.6.1.4.1.311.20.2.3;UTF8:duane.e.waddle@accenturefederal.com"
    },

aws --profile mdr-common-services-gov --region us-gov-east-1 acm-pca issue-certificate \
  --api-passthrough file://./tmp.policy \
  --certificate-authority-arn arn:aws-us-gov:acm-pca:us-gov-east-1:701290387780:certificate-authority/cb0ea325-a347-4297-9cb8-2134410c3889 \
  --csr file://./tmp.csr.b64 \
  --signing-algorithm SHA512WITHECDSA \
  --template-arn arn:aws-us-gov:acm-pca:::template/EndEntityClientAuthCertificate_APIPassthrough/V1 \
  --validity Value=820,Type=DAYS

output should be something like:

{
    "CertificateArn": "arn:aws-us-gov:acm-pca:us-gov-east-1:701290387780:certificate-authority/31c0098a-2bef-4033-9a59-9b2ec0dad0b3/certificate/543c2f65792c3b79bfa78e1a81163886"
}

Get the certificate that was issued. Be sure to update the certificate-arn to what you got.

aws --profile mdr-common-services-gov --region us-gov-east-1 acm-pca get-certificate \
--certificate-authority-arn arn:aws-us-gov:acm-pca:us-gov-east-1:701290387780:certificate-authority/cb0ea325-a347-4297-9cb8-2134410c3889 \
--certificate-arn <insert-certificate-arn-here> \
--output text > tmp.crt

Fix the file

Must be a bug. Right now, tmp.crt has a tab in place of a newline.

vim tmp.crt
# find the line that says `-----END CERTIFICATE----- -----BEGIN CERTIFICATE-----` and separate into two lines

Import the cert to the key

yubico-piv-tool -s 9a -a verify -a import-certificate -i tmp.crt

Import the root and intermediate CAs

# cd to instrastructure-notes location
ykman piv certificates import 82 infrastructure-notes/files/xdr_subordinate_ca.identity.crt
ykman piv certificates import 83 infrastructure-notes/files/xdr_root_ca.crt

Add Certificates to Keychain Access

Open Keychain Access on Mac. Category > All Items

Open finder window to infrastructure-notes/files

drag and drop xdr_root_ca.crt and xdr_subordinate_ca.indentity.crt to the keychain access all items window.

Set trust on the root_ca to always trust. Double click on the certificate and click on Trust. Then change dropdown to "Always Trust". You should be prompted for your Computer password.

Remove and reinsert the Yubikey

May be necessary for chrome/web browsers to see the new certificate

Ensure new user has been create in Keycloak

Have an keycloak administrator add your user at https://auth.xdr.accenturefederalcyber.com/auth/admin.

Other useful commands

Check Status:

$ yubico-piv-tool --slot 9a --action status
Version:	4.4.5
Serial Number:	12692795
CHUID:	No data available
CCC:	No data available
Slot 9a:
	Algorithm:	RSA2048
	Subject DN:	CN=frederick.t.damstra@accenturefederal.com, C=US, ST=VA, L=Arlington, OU=XDR, O=AFS
	Issuer DN:	C=US, O=Accenture Federal Services, OU=XDR, CN=XDR Subordinate CA #1
	Fingerprint:	ba6d2cec780dd397a634e9ace59a9739417f9687bfd42c3f3edafaaf89898337
	Not Before:	Jul  7 12:50:21 2021 GMT
	Not After:	Oct  5 13:50:21 2023 GMT
PIN tries left:	3

Read the certicate:

$ yubico-piv-tool --slot 9a --action read-certificate
-----BEGIN CERTIFICATE-----
...

Validate:

$ yubico-piv-tool --slot 9a --action read-certificate | openssl x509 -noout -text Certificate:

Data:
    Version: ...


### Troubleshooting

Required for windows?

yubico-piv-tool -a set-chuid

Required for mac

yubico-piv-tool -a set-ccc

yubico-piv-tool -a change-puk -P 12345678

Enter new code

Start the yubikey manager app and change the management code:

Basically, generate and protect with pin

Recorded here: 19f22f18cb3b38ab1e13627cab5b7db3e34fe3d9e1aa153b

brew install pkcs11-helper brew install opensc pkcs11-tool --test --login

enter pin



To pair with your macboos login:

sudo sc_auth identities sudo sc_auth pair -u duane.e.waddle -h 6457632695DEB718A2D13BC1E6F038F82CB7AB85 ```

For Firefox

In firefox, go to about:config, search for "security.enterprise" and set security.enterprise_roots.enabled to True
brew install opensc
In Firefox, go to Settings->Preferences, then Privacy & Security, then find Certificates and click the button marked 'Security Devices'.
Click 'Load'
Enter OpenSC PKCS#11 in the module field name.
Enter /usr/local/lib/opensc-pkcs11.so in the Load box.
Click "Okay".

SHould be good to go!

Yubikey Notes.md 6.2 KB Historia Czysty