Your submission was sent successfully! Close

Jump to main content
  1. Blog
  2. Article

Joshua Powers
on 4 May 2020

Enhanced SSH and FIDO authentication in Ubuntu 20.04 LTS

This article originally appeared on Joshua Powers’ blog

One of the most exciting security enhancements in Ubuntu 20.04 LTS (Focal Fossa) is the ability to use the Fast Identity Online (FIDO) or Universal 2nd Factor (U2F) devices with SSH. By using a second authentication factor via a device, users can add another layer of security to their infrastructure through a stronger and yet still easy to use mechanism for authentication. Ubuntu 20.04 LTS includes this feature out of the box through the latest version of OpenSSH 8.2

For users, once keys are in place only a tap of the device is required to log in. For administrators looking to use FIDO or U2F on the server side all that is required is a version of OpenSSH server, 8.2 or newer, that supports the new key types. 

The new public key types and certificates “ecdsa-sk” and “ed25519-sk” support such authentication devices. General handling of private and public key files is unchanged; users can still add a passphrase to the private key. By using a second factor the private SSH key alone is no longer enough to perform authentication. And as a result a compromised private key does not pose a threat.

The following section demonstrates how users can generate new key types and use them to perform authentication. First, users have to attach a device to the system. Next, they need to generate a new key and specify one of the new types. During this process users will get prompted to tap the token to confirm the operation:

ubuntu@focal-openssh-client:~$ ssh-keygen -t ecdsa-sk
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator
to authorize key generation.

Enter file in which to save the key

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in

Your public key has been saved in

Users can then confirm whether the new private and public keys were created:

ubuntu@focal-openssh-client:~$ l .ssh/id_ecdsa_sk*
-rw------- 1 ubuntu ubuntu 610 mar 30 17:58 .ssh/id_ecdsa_sk
-rw-r--r-- 1 ubuntu ubuntu 221 mar 30 17:58 .ssh/

To use these keys all a user needs to do is copy the keys as they would do normally, using ssh-copy-id . This is done by ensuring the public key is added to ~/.ssh/authorized_keys file on the system they wish to connect to.

To log in to a device using the keys, a user can execute the following command:

~$ ssh -i .ssh/id_ecdsa_sk

Confirm user presence for key ECDSA-SK
Welcome to Ubuntu Focal Fossa (development branch)
(GNU/Linux 5.4.0-18-generic x86_64)
Last login: Mon Mar 30 20:29:05 2020 from

The prompt to confirm a user’s presence will appear and wait until the user touches the second factor device.

At the time of writing this post, there is a problem with displaying the prompt when using GNOME. Please refer to the Launchpad bug for more information about the expected fix date.

Download Ubuntu 20.04 LTS (Focal Fossa).

Related posts

Massimiliano Gori
19 February 2023

Air gapped network: FIPS 140 compliance with Ubuntu

FIPS Article

Set up secure air gapped network and automate hardening, patch management and standards like CIS, DISA-STIG and FIPS 140-2 certifications on Ubuntu. ...

19 September 2023

라이브패치(Livepatch)에 새로운 13개월 슬라이딩 지원 기간이 있습니다. 여러분에게 어떤 의미가 있을까요?

Security Security

라이브패치는 시스템을 즉시 재부팅할 필요 없고 런타임에 중요하고 높은 보안 커널 공통 보안 취약성 및 노출(CVE)을 수정하는 유용한 툴입니다. 그러나 정기적인 유지 관리 기간 및 재부팅을 대체하는 용도로 사용해서는 안 됩니다. 좋은 기업 정책에는 시스템이 안정적이고 안전하게 유지되도록 라이브패치와 정기적인 재부팅이 모두 포함되어야 합니다. 그 이유는 펌웨어 또는 장치 드라이버 업데이트와 같은 일부 시스템 CVE는 ...

Aaron Whitehouse
12 September 2023

Ubuntu updates, releases and repositories explained

Cloud and server Article

Since we launched Ubuntu Pro’s Expanded Security Maintenance for additional packages, and we now integrate more closely with public cloud update management tools, more people have been asking us about the Ubuntu archive and how this is divided and security patched. In this blog we will therefore explain Ubuntu releases, how the Ubuntu arc ...