alt Hacker NewsIf you're using -sk keys (i.e. setup via FIDO2 on the Yubikey like the article, not PIV) yes you can forward the keys loaded into your agent like normal, with ssh -A.
Replies
entrope • today at 6:54 PM
Thanks to both you and the other person who replied. I appreciate the education.
PIV keys can also be forwarded through an agent. The only thing to be aware of is that the agent process will effectively cache your PIN if you do this.
ssh-add -s <pkcs11.so>
To mitigate that you can add -c to the ssh-add command. That will make the agent prompt for confirmation (on the host with the PIV key) every time something asks to use it. Doesn't quite get you the same security as just not caching the PIN to start with but it's OK.