iOS apps that lets you SSH into a server using Yubikey 5 NFC with Public Key authentication and gpg-agent

Question

I have a Yubikey 5 NFC, and iPhone 11. I am also running an Ubuntu Server. To log into my server on from mac using ssh. I use ssh with gpg-agent and public key authentication, and have the private (gpg) key credentials stored on my Yubikey 5 NFC in the gpg format. So I log into my server from Mac OS by sshing into my server with my yubikey (using gpg-agent). My yubikey authenticates into the server perfectly.

To make this work with Yubikey 5 (on MacOS), I have the following lines in my .zshrc file:

# Make gpg check for yubikey on startup and insertion
gpg-connect-agent "scd serialno" "learn --force" /bye

# Launch gpg-agent for use by ssh
export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
gpgconf --launch gpg-agent

I tried browsing the apple app store for iOS terminal emulators compatible with Yubikeys for ssh commands. I was hoping to find a Yubikey SSH compatible app but couldn't find anything. After browsing the app store for quite some time, I can't seem to find any terminal emulator app descriptions that show ssh compatibility with Yubikeys.

My question is, is there a terminal or ssh app for iOS that would allow me to ssh into my server in a similar fashion using the NFC protocol on my Yubikey 5 NFC? Any links or apps would be much appreciated.

Answer 1

Termius supports Yubikeys on iOS. However, they're FIDO2 not GPG.

That said, you can use multiple methods to SSH to servers, and if you want it backed by a physical key the single Yubikey can work for both.

If you're looking for key-based auth from iOS Termius also support keys generated in the Secure Enclave and requiring biometrics. You could put both your Yubi GPG key on your server for desktop SSH access and the Termius key for iOS access.

FWIW, I've found PKCS11 easier on Mac to SSH with than GPG. You can use the OpenSC libraries and have it load in your cert to your ssh agent on first try with a PIN, so keeping 2FA and it's physically backed by the Yubi.