YubiKey Manager (ykman)¶

Command line tool for managing yubikey config on linux and macOS.

Some Interesting Commands¶

ykman info¶

$ ykman info
Device type: YubiKey 5 Nano
Serial number: 20680971
Firmware version: 5.4.3
Form factor: Nano (USB-A)
Enabled USB interfaces: OTP, FIDO, CCID

Applications
Yubico OTP      Enabled
FIDO U2F        Enabled
FIDO2           Enabled
OATH            Enabled
PIV             Enabled
OpenPGP         Enabled
YubiHSM Auth    Enabled

Install¶

• Official package (yubico.com): Some distros lag behind.

The following show where you can find up to date versions of ykman.

Fedora¶

Install ykman from fedora repositories:

sudo dnf install yubikey-manager
# Generate bash completion
source <(_YKMAN_COMPLETE=bash_source ykman | sudo tee /etc/bash_completion.d/ykman)

debian / ubuntu¶

• Ubuntu 22.04 is a major version behind: 4.0.7 vs 5.4.0

Add and install ykman from yubico PPA repository:

sudo add-apt-repository ppa:yubico/stable && sudo apt-get update
sudo apt install yubikey-manager # 2024-06-09 yubikey-manager-5.4.0
# Generate bash completion
source <(_YKMAN_COMPLETE=bash_source ykman | sudo tee /etc/bash_completion.d/ykman)

WSL - Windows Subsystem for Linux¶

• Install YubiKey Manager GUI on Windows.
• Use ssh-sk-helper.exe to pass FIDO SSH requests to Windows.
• Configure passthrough to WSL Linux? I haven't. Maybe checkout usbipd-win but I'd rather not have to review the security of that.

Windows¶

• Download from yubico (yubico.com

macOS¶

1. Download and install the official package from Yubico (yubico.com.

2. Add to your path:

   export PATH="$PATH:/Applications/YubiKey Manager.app/Contents/MacOS"
   

3. Setup bash completion:

source <(_YKMAN_COMPLETE=bash_source ykman | sudo tee /etc/bash_completion.d/ykman)