--- title: Enhanced SSH and FIDO authentication in Ubuntu 20.04 LTS description: Ubuntu 20.04 LTS delivers Fast Identity Online (FIDO) to enable Universal 2nd Factor (U2F) devices with enhanced SSH out of the box. url: https://canonical.com/blog/enhanced-ssh-and-fido-authentication-in-ubuntu-20-04-lts?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Joshua Powers](https://canonical.com/blog/author/powersj "More about Joshua Powers") 4 May 2020 # Enhanced SSH and FIDO authentication in Ubuntu 20.04 LTS [20.04 LTS](https://canonical.com/blog/tag/20-04-lts) [Identity Management](https://canonical.com/blog/tag/identity-management) [Security](https://canonical.com/blog/tag/security) [Server](https://canonical.com/blog/tag/server) --- Share the article *This article originally appeared on [Joshua Powers’ blog](https://powersj.io/post/ubuntu-focal-enhanced-ssh/)* One of the most exciting security enhancements in [Ubuntu 20.04 LTS (Focal Fossa)](https://ubuntu.com/download/server) is the ability to use the Fast Identity Online (FIDO) or Universal 2nd Factor (U2F) devices with SSH. By using a second authentication factor via a device, users can add another layer of security to their infrastructure through a stronger and yet still easy to use mechanism for authentication. Ubuntu 20.04 LTS includes this feature out of the box through the latest version of [OpenSSH 8.2](https://www.openssh.com/txt/release-8.2). For users, once keys are in place only a tap of the device is required to log in. For administrators looking to use FIDO or U2F on the server side all that is required is a version of OpenSSH server, 8.2 or newer, that supports the new key types. The new public key types and certificates “ecdsa-sk” and “ed25519-sk” support such authentication devices. General handling of private and public key files is unchanged; users can still add a passphrase to the private key. By using a second factor the private SSH key alone is no longer enough to perform authentication. And as a result a compromised private key does not pose a threat. The following section demonstrates how users can generate new key types and use them to perform authentication. First, users have to attach a device to the system. Next, they need to generate a new key and specify one of the new types. During this process users will get prompted to tap the token to confirm the operation: ``` ubuntu@focal-openssh-client:~$ ssh-keygen -t ecdsa-sk Generating public/private ecdsa-sk key pair. You may need to touch your authenticator to authorize key generation. Enter file in which to save the key (/home/ubuntu/.ssh/id_ecdsa_sk): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/ubuntu/.ssh/id_ecdsa_sk Your public key has been saved in /home/ubuntu/.ssh/id_ecdsa_sk.pub ``` Users can then confirm whether the new private and public keys were created: ``` ubuntu@focal-openssh-client:~$ l .ssh/id_ecdsa_sk* -rw------- 1 ubuntu ubuntu 610 mar 30 17:58 .ssh/id_ecdsa_sk -rw-r--r-- 1 ubuntu ubuntu 221 mar 30 17:58 .ssh/id_ecdsa_sk.pub ``` To use these keys all a user needs to do is copy the keys as they would do normally, using ssh-copy-id . This is done by ensuring the public key is added to ~/.ssh/authorized\_keys file on the system they wish to connect to. To log in to a device using the keys, a user can execute the following command: ``` ubuntu@focal-openssh-client: ~$ ssh -i .ssh/id_ecdsa_sk 10.0.100.75 Confirm user presence for key ECDSA-SK (...) Welcome to Ubuntu Focal Fossa (development branch) (GNU/Linux 5.4.0-18-generic x86_64) (...) Last login: Mon Mar 30 20:29:05 2020 from 10.0.100.1 ubuntu@focal-openssh-server:~$ ``` The prompt to confirm a user’s presence will appear and wait until the user touches the second factor device. At the time of writing this post, there is a problem with displaying the prompt when using GNOME. Please refer to the [Launchpad bug](https://bugs.launchpad.net/ubuntu/+source/gnome-shell/+bug/1869897) for more information about the expected fix date. Download [Ubuntu 20.04 LTS (Focal Fossa)](https://ubuntu.com/download/server). ##### Stay secure and supported with Ubuntu Pro. Enjoy 5 extra years of peace of mind with enhanced security, compliance, and rebootless patching until 2030. [Subscribe to Ubuntu Pro now!](https://ubuntu.com/pro ) [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026