Bitwise Onchain Dev & Ops

Server public key generation procedure

Install openssh and pwgen

A primary owner will generate ECDSA-SK (the SK stands for Security Key) keys using their local machine. This requires OpenSSH 8.2+ and is generated in combination with a U2F (FIDO2) device.

You may need to upgrade your local openssh installation (e.g. brew install openssh on OS X or sudo apt-get install openssh on Linux).

The key will require a minimum 24 character mixed case alphanumeric passphrase and a click of your first FIDO device. You should store the passphrase securely in at least 2 places.

You can use the pwgen tool (brew install pwgen on OS X or sudo apt-get install pwgen on Linux) to get a suitable passphrase.

Note on M1 OS X (ARM processor)

If you are using an M1 OS X (ARM processor) then the Homebrew tool may not work, so it is recommended to run the commands in the emulator:

arch -x86_64 brew install openssh

This may require the Rosetta 2 terminal

/usr/sbin/softwareupdate --install-rosetta --agree-to-license

Validating server key creation

The validating server infrastructure has a set of shared keys across all servers which is a slightly reduced security stance since there are no private keys on any of the servers.

Generate a collection of passwords to use when protecting the server keys (remember to copy the password somewhere safe and separate from the hardware):

pwgen -B 24

Enter the command (use prd, tst, dev for Production, Test and Development respectively):

ssh-keygen -t ecdsa-sk -f ~/.ssh/id_<initials>_prd_<1,2,3>

You should repeat the above step for two other devices (with fresh passwords for each) as backup credentials in case of device absence. Ensure that you remove all other FIDO devices and then insert the one you'll be using to avoid accidentally reusing a hardware key. It is wise to mark these devices with their ID so you don't lose track of them (a plastic keyring is recommended) - see the Storing Keys section later for more details.

This will give you a collection of local files as follows (for Alice Bob with initials ab):

~/.ssh/id_ab_prd_1
~/.ssh/id_ab_prd_1.pub

~/.ssh/id_ab_prd_2
~/.ssh/id_ab_prd_2.pub

~/.ssh/id_ab_prd_3
~/.ssh/id_ab_prd_3.pub

You now need to add the public keys to the github.com/attestantio/ops GitHub repository. First cat the public keys:

cat ~/.ssh/id_ab_prd_1.pub
cat ~/.ssh/id_ab_prd_2.pub
cat ~/.ssh/id_ab_prd_3.pub

Verify that each public key starts with:

sk-ecdsa-sha2-nistp256@openssh.com

Without this prefix then the 2FA mechanism will not be accepted and you won't have access.

Modify the “comment” section of the public key (after the “== ”) to <initials>-<env>-<1,2,3> e.g. ic-dev-1

Typically new public keys will be added to /ops/ansible/roles/ssh/files. Follow the usual procedure for updating a GitHub repository to add new keys as they become available.