ssh: T7483: Add fido2 PubkeyAuthOptions

[scj643]

Change summary

Add PubkeyAuthOptions to allow requiring touch and user verification.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related PRs

• ssh: T7483: Document fido2 options vyos-documentation#1708

Related Task(s)

https://vyos.dev/T7483

How to test / Smoketest result

Run ssh with these options enabled and verify that it requires touch and pin verification.

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[dmbaturin]

This is certainly a useful addition. I'm not a big fan of the name verify-required and might prefer that syntax to be require <verification|touch>.

The current syntax mirrors OpenSSH options from https://man.openbsd.org/sshd_config#PubkeyAuthOptions that might be familiar to OpenSSH users. This is a purely aesthetic considerations and I don't consider it a blocker for merging this PR.

[c-po]

Hi @scj643,

thanks for the contribution - as @dmbaturin already outline the CLI could be improved. Let me throw in another idea:

set service ssh fido pin-required
set service ssh fido touch-required

[scj643]

Hi @scj643,

thanks for the contribution - as @dmbaturin already outline the CLI could be improved. Let me throw in another idea:

set service ssh fido pin-required

set service ssh fido touch-required

That sounds great. I'll change that later today.

[scj643]

Changes made and updated the documentation.

[c-po]

The documentation could use an example on how to set this up and get it working. Please also extend the SSH Smoketests to verify the CLI nodes actually males it into the sshd_config

[github-actions]

CI integration 👍 passed!

Details

CI logs

• CLI Smoketests (no interfaces) 👍 passed
• CLI Smoketests VPP 👍 passed
• CLI Smoketests (interfaces only) 👍 passed
• Config tests 👍 passed
• Config tests VPP 👍 passed
• RAID1 tests 👍 passed
• TPM tests 👍 passed