SSH Auth using FIDO Device

Step 1: Plugin FIDO Device (Ex: Google Titan Security Key). Run this command

ssh-keygen -t ecdsa-sk

If the error "Key enrollment failed: unknown or unsupported key type" appear.
1. Update OpenSSH to latest version or version 8.9. On MacOS you may use Homebrew
2. Install libfido2
https://github.com/Yubico/libfido2/blob/master/README.adoc#installation

Step 2: Choose where to save the key (id_ecdsa_sk). And enter passphrase for more protection (optional)

Step 3: Go to the directory that you save the key, copy the id_ecdsa_sk.pub to your server. You can copy its content and use nano on your server to create a id_ecdsa_sk.pub file then paste the content of the key into this file.

Step 4: Add the public key into the authorized_keys files (Which normally located in  ~/.ssh). You may use this command bellow

cat id_ecdsa_sk.pub >>  ~/.ssh/authorized_keys

Step 5: Open sshd_config file (Which located in ~/.ssh/sshd_config or /etc/ssh/sshd_config). Then uncomment this line, or you can add this line into the config file

PubkeyAuthentication yes

You may disabled the Password Authentication

PasswordAuthentication no

Step 6: Now restart your SSH service

sudo service ssh restart

OR

sudo service sshd restart

Step 7: Reconnect and you will be asked for the authentication key, just plug the FIDO Device then touch it. The authenciation will be completed automatically