FiloSottile

yubikey-agent

Go2020–2026

FiloSottile / yubikey-agent

yubikey-agent

yubikey-agent is a seamless ssh-agent for YubiKeys.

Security & Privacy Networking

Explore on GitHub Read Hacker News discussions

13Distinct people

16Mentions

0Explicit recommenders

2.9KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

yubikey-agent is a seamless ssh-agent for YubiKeys.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year16 dated mentions

Observed mentions: 2020-05-10 03:19:27 UTC to 2026-04-03 17:59:58 UTC.

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	5	1	4
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	2	0	2
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	4	0	4
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	4	0	4
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	0	0	0
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	0	0	0
2026 (partial)	2026-01-01 00:00:00 UTC	2027-01-01 00:00:00 UTC	1	0	1

What Hacker News says

16 sources

agwa·Apr 3, 2026

Instead of using a CA, why not set the key's PIN policy to "once" and use an agent (e.g. https://github.com/FiloSottile/yubikey-agent/) that holds an active session to the yubikey? You start the agent at the beginning of the day, enter the PIN once, and then stop the agent at the end of the day.

In SSH certificates: the better SSH experience

zoidb·Sep 15, 2023

Might also want to check out https://github.com/FiloSottile/yubikey-agent as a very simple way to setup a yubi-key as an ssh-agent.

In An Opinionated Yubikey Set-Up Guide

linsomniac·Jul 29, 2023

The ; got included in the yubikey-agent URL: https://github.com/FiloSottile/yubikey-agent Thanks for those pointers!

In Show HN: ssh-tpm-agent – SSH agent for TPMs

lathiat·Jul 29, 2023

This is a great idea. I now exclusively use SSH keys on hardware security modules of some kind. I use "Secretive", a mac app that does the same, plus a yubikey using yubikey-agent (https://github.com/FiloSottile/yubikey-agent; there are too many complicated ways to use SSH keys with a yubikey this is one of the friendliest ones). Depending on the security and frequency of which I access the service impacts whether I need presence confirmation or use secretive versus the yubikey. I would be remiss to mention there are existing SSH TPM projects, not sure how this one differentiates. It seems to at least have the user experience pretty simple, similar to yubikey-agent (and secretive), and unlike some of the existing solutions which have quite a few extra steps: https://github.com/tpm2-software/tpm2-pkcs11/blob/master/doc... I really love it

Read the rest

when projects like this address there are "competitors" or other software in the space and provide a fair comparison. It would be great to see one of those here :) For example you can easily use SSH FIDO keys but they aren't supported by all server sides, ECDSA keys often are (though not always!) etc :)

In Show HN: ssh-tpm-agent – SSH agent for TPMs

zoidb·Mar 10, 2023

Also check out https://github.com/FiloSottile/yubikey-agent which simplifies the setup quite a bit.

In Secretive: Store SSH Keys in the Secure Enclave

yencabulator·Oct 1, 2022

You can use PIV for SSH just fine. It's not OpenSSH's weird FIDO mode, but I don't like the FIDO mode anyway because it requires storing a file on the computer. https://github.com/FiloSottile/yubikey-agent

In Cloudflare Hardware Keys (Yubico Partnership)

markstos·May 30, 2022

Unless I've missed something, SSH keys stored on Yubikeys are still hampered because you aren't allowed to a touch policy of "touch never". Imagine needing to touch the Yubikey with each "git pull" or using Ansible to operate over SSH on a dozen servers in parallel, and needing to touch the Yubikey once for each server. The feature request I'm tracking is here: https://github.com/FiloSottile/yubikey-agent/issues/95 The proposed feature would allow setting a touch policy for the SSH key.

In How to Store an SSH Key on a Yubikey

xvector·May 30, 2022

https://github.com/FiloSottile/yubikey-agent has worked really well for me in the past.

In How to Store an SSH Key on a Yubikey

FiloSottile·Apr 29, 2022

https://github.com/FiloSottile/passage :) That's exactly the use case I set out to replace for myself. I'll put together a guide at some point. The part I don't use and so can't really own is the mobile app, I would love a community solution there. I am also planning to integrate https://github.com/FiloSottile/yubikey-agent which makes the SSH authentication part very easy, so that you only type your PIN once and it stays cached.

In Ask HN: CLI Tool for File Encryption?

yencabulator·Sep 15, 2021

And you can use a Yubikey hardware key as a ecdsa-sha2-nistp384 secret store, without messing with PAM or needing custom key types or special files on the client host: https://github.com/FiloSottile/yubikey-agent

In FreeBSD SSH Hardening

ava1ar·May 10, 2021

Finally! Was using https://github.com/FiloSottile/yubikey-agent before and now probably can migrate out of it since github was holding me back.

In Security keys are now supported for SSH Git operations

wolf550e·Sep 4, 2020

I guess you can use https://github.com/FiloSottile/yubikey-agent to store an ssh key on a yubikey, and then use age to encrypt to the ssh key. Getting minisign to sign using a key in a ubikey is not supported out of the box, but should be possible in the same way yubikey-agent works (after all, that's what it does when you authenticate an ssh session using a yubikey). You can ask Filippo Valsorda.

In GnuPG 2.2.23

xaduha·Jul 1, 2020

You're using yubikey agent or ykcs11 or yubico-piv-tool or somesuch nonsense most likely that actually provides PKCS#11. That is it wraps whatever PIV is supposed to do and gives you PKCS#11 interface. I'm talking about something that isn't Yubico specific and provides PKCS#11 and PKCS#15 with OpenSC straight ootb. e.g. issues that described here are avoided https://github.com/FiloSottile/yubikey-agent#alternatives

In How to use FIDO2 USB keys with SSH

Xylakant·Jun 30, 2020

Yubikeys work in PIV mode with openssh, it just requires the necessary module and some invocation dance with ssh-agent https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK... or Filippo Valsordas yubikey-agent https://github.com/FiloSottile/yubikey-agent

In How to use FIDO2 USB keys with SSH

miguelmota·Jun 28, 2020

I've been using a YubiKey device for SSH using yubikey-agent [0] and it's been great since it’s not possible to extract keys from hardware keys and the device is carried with me. The agent is also integrated with pinentry so it requires a pin code for the session. [0] https://github.com/FiloSottile/yubikey-agent

In Secretive – macOS native app to store SSH keys in the Secure Enclave

Showing the 15 most recent of 16 sources. Enable JavaScript to search and browse every indexed mention.