Skip to content

Instantly share code, notes, and snippets.

@spoelstraethan
spoelstraethan / yubikey-crosh-secure-shell.md
Last active February 10, 2025 22:13 — forked from espoelstra/yubikey-crosh-secure-shell.md
Access ChromeOS chronos user shell via ssh (requires root/sudo for initial setup and once per boot for non-local iptables rule and starting /usr/bin/sshd) with SSH key passwordless auth

Why oh why

I want to develop some scripts for things like Chrx, Chromebrew, MrChromebox scripts etc and I don't want to register a new SSH key to my account every time I need to powerwash or use recovery on one of my Chromebooks because I messed it up. I already use my Yubikey for GPG/FIDO/U2F/SSH on all the other systems I develop on, and I only needed the SSH portion to work for this particular use case. I also didn't want to deal with using Crouton or Crostini since that requires additional downloads and more configuration and complexity.

Challenges

Since the Crosh userland doesn't have scdaemon or pcscd for talking to the smart card, I had to come up with another way to access the Yubikey and make the SSH key available. I ended up trying a few different things to make it work, but overall the solution ended up being brilliantly straightforward. Originally I tried using Chromebrew to install one of the smartcard access/manager packages, but the dependency chain ended up pulling in Gnome keyring and a