# Fido U2F SSH authentication (2FA/MFA) **URL:** \ **Category:** Network and Wireless Configuration\ **Created:** [July 9, 2020, 8:45am UTC](https://forum.openwrt.org/t/fido-u2f-ssh-authentication-2fa-mfa/68872 "2020-07-09T08:45:04Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![perceival](https://forum.openwrt.org/user_avatar/forum.openwrt.org/perceival/32/12041_2.png) [@perceival](https://forum.openwrt.org/u/perceival)\ **Post date:** [July 9, 2020, 8:45am UTC](https://forum.openwrt.org/t/fido-u2f-ssh-authentication-2fa-mfa/68872/1 "2020-07-09T08:45:04Z")
Since version 8.2 OpenSSH is supporting U2F MFA. Here is short guide on how to enable two (or three) factor SSH authentication using physical key (like Yubikey) for accessing OpenWrt console. Prerequisities: - U2F key (second key strongly advised to not get locked out in case of key loss) - sufficient amount of memory in OpenWrt appliance On Linux: ``` ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk ssh-copy-id -i ~/.ssh/id_ecdsa_sk root@router_IP ``` On router: ``` uci set dropbear.@dropbear[0].Port=2222 uci commit dropbear /etc/init.d/dropbear restart ``` After that you should be able to reach out to router by: `ssh -p 2222 root@router_IP` ``` opkg update opkg install openssh-server ``` Change lines on the router /etc/ssh/sshd\_config file to: ``` ListenAddress LAN_IP_of_the_router # optional PasswordAuthentication no ``` and run following commands: ``` /etc/init.d/sshd enable /etc/init.d/sshd start ``` if connection with `ssh root@router_IP` works fine with Fido2 key you are ready to disable dropbear: ``` /etc/init.d/dropbear disable /etc/init.d/dropbear stop ``` Linux part of setup should be repeated for second key using different file names. Alternatively backup authentication could be setup with Google Authenticator. ---
**Author:** ![perceival](https://forum.openwrt.org/user_avatar/forum.openwrt.org/perceival/32/12041_2.png) [@perceival](https://forum.openwrt.org/u/perceival)\ **Post date:** [September 24, 2020, 5:17pm UTC](https://forum.openwrt.org/t/fido-u2f-ssh-authentication-2fa-mfa/68872/2 "2020-09-24T17:17:48Z")
Some remarks: 1. Linux requires libfido2 or libsk-libfido2.so to be installed for ecdsa-sk to work. 2. Not all fido keys are supporting ed25519-sk (but even the cheapest ones should support ecdsa-sk) 3. Last time I have checked putty wasn't supporting either. ---
**Author:** ![highpost](https://forum.openwrt.org/user_avatar/forum.openwrt.org/highpost/32/3204_2.png) [@highpost](https://forum.openwrt.org/u/highpost)\ **Post date:** [September 29, 2020, 9:01pm UTC](https://forum.openwrt.org/t/fido-u2f-ssh-authentication-2fa-mfa/68872/3 "2020-09-29T21:01:12Z")
OpenWRT 19.07.4 includes packages for OpenSSH 8.0p1, not 8.2p1. Is the assumption here that you're building OpenWRT from source? ---
**Author:** ![perceival](https://forum.openwrt.org/user_avatar/forum.openwrt.org/perceival/32/12041_2.png) [@perceival](https://forum.openwrt.org/u/perceival)\ **Post date:** [September 29, 2020, 10:21pm UTC](https://forum.openwrt.org/t/fido-u2f-ssh-authentication-2fa-mfa/68872/4 "2020-09-29T22:21:37Z")
Indeed. I am building from master branch. Obviously you don't need to build by yourself and instead use for example @hnyman 's master build. ---
**Author:** ![highpost](https://forum.openwrt.org/user_avatar/forum.openwrt.org/highpost/32/3204_2.png) [@highpost](https://forum.openwrt.org/u/highpost)\ **Post date:** [September 30, 2020, 9:32am UTC](https://forum.openwrt.org/t/fido-u2f-ssh-authentication-2fa-mfa/68872/5 "2020-09-30T09:32:52Z")
You mean [Build for Netgear R7800](https://forum.openwrt.org/t/build-for-netgear-r7800/316)? I may give that a try. ---
**Author:** ![perceival](https://forum.openwrt.org/user_avatar/forum.openwrt.org/perceival/32/12041_2.png) [@perceival](https://forum.openwrt.org/u/perceival)\ **Post date:** [September 30, 2020, 10:33am UTC](https://forum.openwrt.org/t/fido-u2f-ssh-authentication-2fa-mfa/68872/6 "2020-09-30T10:33:04Z")
Yeah, current one is: > **[master-r14607-3fab4ace57-20200929](https://www.dropbox.com/sh/ew0gap0crn30wyk/AABnMGtNsGJkcj9jCl3B3WLNa/master-r14607-3fab4ace57-20200929?dl=0&subfolder_nav_tracking=1)** > > Shared with Dropbox ---
**Author:** ![linosgian](https://forum.openwrt.org/user_avatar/forum.openwrt.org/linosgian/32/29763_2.png) [@linosgian](https://forum.openwrt.org/u/linosgian)\ **Post date:** [January 5, 2021, 8:44pm UTC](https://forum.openwrt.org/t/fido-u2f-ssh-authentication-2fa-mfa/68872/7 "2021-01-05T20:44:25Z")
Hi, I've recently bought a Solokey, which implements FIDO2 as well and I have been using it on my router for a while now. Since OpenSSH is already on 8.4p on master, I've opened a [PR](https://github.com/openwrt/packages/pull/14415) to add support for all FIDO2 keys on the official OpenWRT `openssh-server` package. Also, a few notes: libsk-libfido2 is not required anymore by OpenSSH anymore. All that's needed is libcbor, libfido2 itself and OpenSSH to be compiled with the `--with-security-key-builtin` flag. If anyone wants to compile their own `openssh-server` package, feel free to use this [PR](https://github.com/openwrt/packages/pull/14415). Hopefully it'll get merged at some point and it'll probably land on the next OpenWRT release. Instead of building your own OpenWRT image from scratch, you can just build the openssh-server package using the compiled OpenWRT SDK for your current version. You can find more information [here](https://github.com/mwarning/openwrt-examples/blob/master/openwrt-sdk.md)