DEV Community: uyriq

A step-by-step guide to setting up SSH authentication with YubiKey 5.7 or later version and ED25519-SK keys on Windows 11.

uyriq — Tue, 04 Mar 2025 19:58:15 +0000

Here is the corrected version of your post with grammar, spelling, and clarity improvements:

Setting Up YubiKey for SSH on Windows 11

Prerequisites

A YubiKey 5.7 (or later) security key with a user PIN activated for FIDO2 functionality
Git installed and a GitHub repository
GitHub CLI tool (gh)
Administrator rights for ykman operations

Step 1: Install YubiKey CLI and GUI Tools, Set PIN for FIDO

YubiKey offers two management tools:

winget install Yubico.YubiKeyManagerCLI # Deprecated Windows app
winget install Yubico.YubikeyManager  # Modern CLI tool: ykman

Run the following command in an administrative terminal to set or change your PIN:

ykman fido access change-pin

Alternatively, you can set the PIN using the YubiKey Manager GUI.

Step 2: Configure GPG Agent for SSH Support

Locate and edit (or create if missing) the following configuration file:

$env:AppData\Roaming\gnupg\gpg-agent.conf

Alternatively, it may be under the .gnupg directory. Add or update the file with:

# Enable SSH support through GPG agent
enable-ssh-support
enable-win32-openssh-support
enable-putty-support

# Cache settings
default-cache-ttl 600
max-cache-ttl 7200
default-cache-ttl-ssh 1800
max-cache-ttl-ssh 7200

# Use a standard socket for SSH control
use-standard-socket

Step 3: Generate an ED25519-SK SSH Key

Run the following command to generate an SSH key using the YubiKey:

ssh-keygen -t ed25519-sk -O resident -O verify-required -C "Your Comment"

To generate multiple credentials on the same security key:

ssh-keygen -t ed25519-sk -O resident -O application=ssh:Description -C "Your Comment"

Replace Description with a unique identifier, such as your email.

Step 4: Verify Credentials

Run the following command in an elevated terminal to check stored credentials:

ykman fido credentials list

Example output:

Enter your PIN:
Credential ID   RP ID   Username  Display name
50f...         ssh:    openssh   openssh

Ensure that your SSH public key is added to your GitHub account for code signing and, optionally, for authentication.

GitHub documentation

gh ssh-key add ~/.ssh/ed25519-sk.pub --title "Key linked to YubiKey" --type signing
gh ssh-key add ~/.ssh/ed25519-sk.pub --title "Key linked to YubiKey" --type authentication

Step 5: Test SSH Authentication

Test your SSH connection to GitHub if the key has the authentication option:

ssh -i "C:\Users\User\.ssh\id_ed25519_sk" -T git@github.com

Expected output:

Confirm user presence for key ED25519-SK
SHA256:J...
User presence confirmed
Hi username! You've successfully authenticated, but GitHub does not provide shell access.

Step 6: Configure Git for Signed Commits

Set up your repository for commit signing:

git config --local user.name "your_username"
git config --local user.email "your_username@users.noreply.github.com"
git config --local commit.gpgsign true
git config --local gpg.format ssh
git config --local user.signingkey "C:/Users/Username/.ssh/id_ed25519_sk"

Step 7: Update SSH Config File

Edit ~/.ssh/config to streamline authentication. I recommend adding your key after your primary key to avoid frequent authorization prompts during git fetch:

Host github.com
    User git
    Port 22
    IdentitiesOnly yes
    PreferredAuthentications publickey
    PasswordAuthentication no
    IdentityFile ~/.ssh/id_ed25519.home # Primary key for Git operations
    IdentityFile ~/.ssh/id_ed25519_sk # Additional key if added to GitHub as an authentication key

Step 8: Verify Git Authentication

Try pulling from your repository:

git pull

Expected output:

Confirm user presence for key ED25519-SK
SHA256:...
User presence confirmed
Already up to date.

You will receive the same notification when committing changes.

References

Securing SSH with FIDO2

This guide ensures secure SSH authentication using YubiKey on Windows 🚀

Streamline Your Winget Package Updates with PowerShell

uyriq — Sun, 01 Dec 2024 16:49:22 +0000

For me, updating packages using Winget is almost a daily operation. At least once a day, I type winget update in the terminal to see what’s new for the already installed software. I don’t always update, but sometimes (about every other day), I manually copy and paste package IDs one by one. That’s how wup was born—a PowerShell script that automates working with Winget and made my life easier (it took just two evenings to debug it).

About the Problem, More Formally

Each time I need to update a bunch of packages using Winget, I create a line in the PowerShell session similar to this, which involves a lot of copying and pasting:

winget update --id package.id1; winget update --id package.id2; ... ; winget update --id package.idN

It’s not only tedious but also gets complicated because sometimes --id doesn’t work as expected, as mentioned here. Due to this, I need to use --name instead of --id for updating some packages like pnpm. Such cases are not rare, and sometimes it's the opposite—you can't update by name but can by --id.

The Solution

To solve this problem, I wrote a PowerShell script that lists all possible updates for installed packages when called without arguments, essentially just showing the result of winget update. Then, you can call the script with an argument: it accepts a list of package IDs and updates the listed packages. Note: I still copy and paste the IDs of the desired packages. The copy-paste hasn’t disappeared 😅 ("HelpWanted, need a fzv feature!")

Here’s a brief overview of the script:

List All Updates: If the script is called without any arguments, it lists all possible updates for the installed packages.
Update Specific Packages: If package IDs are provided as arguments, it updates only those specific packages.

How to Use the Script

Download the Script: Get the script and its README from this gist.
Place the Script Anywhere: Place the script in any directory of your choice.
Set Alias in $PROFILE: Add an alias to your $PROFILE for easy access.

Set-Alias -Name wup -Value "Path\To\Script.ps1"

Now, you can simply run wup in your PowerShell session to get the list of updates or provide specific package IDs for updating.

Notes

The gist with the script contains a Readme.md with additional PowerShell thoughts.

If you have any questions or improvements, feel free to contribute!

All code is licensed under the MIT License. Happy updating!

By the way, did you hear about the scrambled [python, not pwsh] developer who couldn’t find his packages? He said, "I guess I’m just egg-sasperated!" 🥚

PowerShell Automation: Execute Batch GitHub CLI Commands

uyriq — Sat, 02 Nov 2024 22:08:00 +0000

Automating Routine Tasks with a PowerShell Script

Working with repositories on GitHub, especially when there are many of them, can be tiresome and time-consuming. When I needed to change the visibility of multiple repositories and manage access rights, I decided to create a cross-platform PowerShell script, batchrepoaction.ps1, which automates routine tasks and saves time and effort.

The Idea Behind the Script

The idea of writing the script came from the need to perform repetitive actions for multiple repositories. For example, changing the repository's visibility from public to private and vice versa, or adding a collaborator. These operations, if done manually through the GitHub interface, require several clicks, reading banners, and scrolling through pages. When there are dozens or even hundreds of such repositories, the task becomes tedious and time-consuming.

In real life, people like HR managers are always interested in our public information and check our repositories. Our team leads request to add or remove access to repositories for our future or former developer colleagues. These situations also motivated me to create this script.

What the Script Does

batchrepoaction.ps1 is written in PowerShell and can work both in PowerShell 5 on Windows "out of the box" and in PowerShell Core, which is available not only on Windows but also on Linux and macOS. The main idea of the script is to get a list of repositories and process them one by one by calling the GitHub CLI utility (gh). This allows executing any GitHub CLI command in the context of working with a repository.

The user must be authorized in GitHub CLI and have the gh tool installed.

The most important parameter of the script is -action. Here’s what I wrote in the help section:

.PARAMETER action
The regular `gh` CLI command to execute e.g., "gh repo edit --visibility private", "gh repo delete"

So, the idea is that the command for gh is passed in action, which will be executed for each repository from the list.

Some gh commands can be quite long and depend on several parameters. Such commands cannot be passed in the current version of the script, so, for example, for getting a list of collaborators and adding a collaborator, I made my own shorthands instead of writing a syntax parser:

list-collaborators

add-collaborator

delete-collaborator

which can be passed in action instead of their long equivalents.

The other gh commands that support one argument are passed in their syntax, so my script is still a wrapper! Moreover, if the syntax of the commands changes a bit, as promised with the upcoming release of the gh repo edit command, it will not affect the functionality of the script, just a slightly different command will be executed for the list of repositories.

It looks like I need to conclude the explanation of the script by providing usage examples step by step:

Changing Repository Visibility

First, get a list of your repositories and save it to a text file:

.\batchrepoaction.ps1 -action "gh repo list" -outputfile repofile.txt

You can now edit repofile.txt, leaving only the repositories needed for the operation.

Run the command to change the visibility of all listed repositories:

.\batchrepoaction.ps1 -repofile repofile.txt -action "gh repo edit --visibility private"

If the number of repositories to be processed is not so large, you can use the -repolist parameter, listing the required repositories in quotes, separated by commas:

powershell

.\batchrepoaction.ps1 -repolist "user/repo1,user/repo2" -action "gh repo edit --visibility private"

Adding a Collaborator to Several Repositories
To add a collaborator to all repositories, use the command:

.\batchrepoaction.ps1 `-repolist` "user/repo1,user/repo2" -collab_permission "push" -collaborator "anygithubusername"

As they say in advertisements, emphasizing the meaning of the word "can", the batchrepoaction.ps1 script can simplify the management of multiple repositories on GitHub by automating routine tasks and allowing you to focus on more important aspects of development. I hope this script will be useful, saving your time and nerves.

Ensuring Secure Connections: How the Get-VPNConnectionInfo Function Identifies VPN Usage

uyriq — Sat, 15 Jun 2024 17:15:16 +0000

Get-VPNConnectionInfo

Overview

The Get-VPNConnectionInfo function checks if the current internet connection is made through one of the known VPN providers. It fetches the current IP information from ipapi.co and compares the organization name (org field) against a predefined list of VPN providers.

Requirements

PowerShell 5.1 or higher.
An Internet connection to perform queries to ipapi.co.
knownVPNproviders.json file in the same directory as the script.

The format of the `knownVPNproviders.json` file.

This JSON file should contain an array of strings, each representing the name of a VPN provider recognized in the org field of a response from ipapi.co or ipinfo.io or other similar online services. The file should be structured as follows:

["VPNProviderName1", "VPNProviderName2", "VPNProviderName3"]

Replace "VPNProviderName1"`,"VPNProviderName2", and"VPNProviderName3" with the real names of the VPN providers you want to recognize. This can be your employer's VPN provider, a personal VPN service, or any other VPN provider you want to discover. The main thing is that this provider should provide specific information in the org field for whois services like ipapi.co/ipinfo.io. So if the org field is empty or non-unique. it can be confusing. but this doesn't happen very often.

Usage.

Make sure that the Get-VPNConnectionInfo function and the knownVPNproviders.json file are in the same directory.
Create the Get-VPNConnectionInfo.ps1 script file in a PowerShell session. You can do this by navigating to the script directory and running the . .\Get-VPNConnectionInfo.ps1 command.
Call the function with Get-VPNConnectionInfo.

Adding it to a PowerShell profile

For convenience, you can add the function to your PowerShell profile so that it is automatically available in every session:

Open the PowerShell profile file for editing. If you do not know where it is located, find it by typing $PROFILE in the PowerShell window.
Add the following line to the profile file:

 . "C:\path\to\to\Get-VPNConnectionInfo.ps1"

Replace "C:\path\to\to\Get-VPNConnectionInfo.ps1" with the actual path to your script.

Save the profile file and restart PowerShell. The Get-VPNConnectionInfo function will now be available in every session.

Function Details.

Input: None.
Output: A custom PowerShell object with the following properties:
- connectedVPN: a boolean value indicating whether or not the current connection is being made through a known VPN provider.
- connect_info: An object containing information about the IP connection, including the name of a potentially suitable VPN provider. You can assume that if the provider name includes the word VPN, it is a suitable service.

The published code has an open license. If you have suggestions, pull requests are welcome.

Powershell to fix incorrect encoding of MP3 ID3 tags

uyriq — Thu, 13 Jun 2024 16:52:56 +0000

This PowerShell script corrects the encoding of ID3 tags in MP3 files. It is specifically designed for the case of a problem where tags encoded in WINDOWS-1251 have been saved to files as WINDOWS-1252 text, and so programs incorrectly output grainy characters (like this one"îñòðîâ") because they read the text as a Western European encoding. So the task is to save tags in modern UTF-8 encoding. TagLibSharp.dll does all the work of reading tags from the file, so to make the script work you need to place this library in the script execution directory. The main purpose of the script is to fix file encoding, but by calling it with the arguments -AllArtists, -AllAlbum, -AllPicture, -AllComment, you can also batch change related meta-properties of files. This script should not be used with diacritic languages, as it considers all these languages to be incorrect Cyrillic characters.

Prerequisites

Before running this script, make sure you have the following:

PowerShell 5.1 or higher.
TagLibSharp.dll: This is required to work with MP3 tags. You can obtain `TagLibSharp.dll by either: By downloading it from NuGet. Or by compiling the source code available on GitHub.
in case of PowerShell 5.1 you need System.Text.Encoding.CodePages.dll (netstandard 2.0) obtain binary package from NuGet that library is defaulted to Powershell Core

How to use

Get TagLibSharp.dll: and optionaly for Powershell 5.1 Get System.Text.Encoding.CodePages
Locate TagLibSharp.dll/System.Text.Encoding.CodePages.dll in the same directory as the script: The script expects TagLibSharp.dll to be in the same directory from which the script is run.
Prepare MP3 files: Make sure that all MP3 files you want to fix are placed in the same directory. The script will process all .mp3 files in the directory from which it is run.
Run the script:.
- Open PowerShell and navigate to the directory containing the script and TagLibSharp.dll.
- Run the script by typing .\convertIDv3tags.ps1 and pressing Enter. The script will process each MP3 file in the catalog, correcting the ID3 tag encoding as described.
- You can optionally pass args as -AllArtists, -AllAlbum, -AllPicture, -AllComment to set the appropriate meta properties for a group of files

Notes

Backup your files:Before running the script, it is recommended that you back up your MP3 files to prevent unintentional data loss.
Script Restrictions: The script is specifically restricted to working with MP3 files. Changing the -Filter *.mp3 parameter to work with other file formats may not produce the desired results, although in general TagLibSharp.dll supports even video.

**NotaBene: if u wish experiment more with TagLibSharp dive in with

Select best cluster of game-servers connection using PowerShell like the Wargaming launcher does. 🚀🎮

uyriq — Fri, 07 Jun 2024 13:37:36 +0000

How to check connection to server clusters using powershell or how to do the same thing that the launcher does when logging into Wargaming and Lesta game account. 🚀🎮

When throwing pebbles into the water, look at the circles formed by them; otherwise, such throwing will be an empty amusement 😉. What do I liken a good MT/WOT ping to? - To a fast projectile hitting the target.

Clusters of game servers for “World of Tanks” and “World of Tanks” are distributed in different regions, and each cluster serves a certain set of servers. The game selects the server based on the lowest ping to the cluster. Probably, additional selection parameters are used, and all this happens at the moment of connection. Also, at any time in the game, you can switch to the available list of servers sorted by ping. If you want to solve the problem of choosing the optimal cluster yourself, you will need to check the ping to each server in each cluster, determine the average ping and its variance, and the less these indicators, the more suitable the cluster for the game. For this purpose, I have written a PowerShell script that performs these actions, displays the results in the console as the list is traversed, and selects the optimal cluster based on the final table. The script code is available on GitHub in the public repo. Instructions on how to use and customize it are in the repo README.

The script accepts a list of server URLs either directly through the -serverList parameter or via a JSON file specified with the -serverListFile parameter. It performs ping tests on each server, calculates the average response time and dispersion, and identifies the optimal server based on these metrics. Note that the script includes all current servers of WoT in the serverlistfile.json. Users can test and measure ping results for these servers as well as for their own list of servers.

.\wotPing.ps1 -pingCount 5 -serverList "ya.ru", "google.com" -serverListFile "serverList.json"
# This command pings "ya.ru", "google.com", and all servers listed in "serverList.json" five times each.

DEV Community: uyriq

A step-by-step guide to setting up SSH authentication with YubiKey 5.7 or later version and ED25519-SK keys on Windows 11.

Setting Up YubiKey for SSH on Windows 11

Prerequisites

Step 1: Install YubiKey CLI and GUI Tools, Set PIN for FIDO

Step 2: Configure GPG Agent for SSH Support

Step 3: Generate an ED25519-SK SSH Key

Step 4: Verify Credentials

Step 5: Test SSH Authentication

Step 6: Configure Git for Signed Commits

Step 7: Update SSH Config File

Step 8: Verify Git Authentication

References

Streamline Your Winget Package Updates with PowerShell

About the Problem, More Formally

The Solution

How to Use the Script

Notes

PowerShell Automation: Execute Batch GitHub CLI Commands

Automating Routine Tasks with a PowerShell Script

The Idea Behind the Script

What the Script Does

Ensuring Secure Connections: How the Get-VPNConnectionInfo Function Identifies VPN Usage

Get-VPNConnectionInfo

Overview

Requirements

The format of the knownVPNproviders.json file.

Usage.

Adding it to a PowerShell profile

Function Details.

Powershell to fix incorrect encoding of MP3 ID3 tags

Prerequisites

How to use

Notes

Select best cluster of game-servers connection using PowerShell like the Wargaming launcher does. 🚀🎮

How to check connection to server clusters using powershell or how to do the same thing that the launcher does when logging into Wargaming and Lesta game account. 🚀🎮

The format of the `knownVPNproviders.json` file.