mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-21 14:35:22 +08:00
Andrew Lytvynov
8492f62d43
By specifying `device_attestation_cas` in `teleport.yaml`, admins can restrict U2F device manufacturers. For example, specifying the yubico attestation CA (https://developers.yubico.com/U2F/yubico-u2f-ca-certs.txt), you can restrict users to only yubikeys. Example error when using the yubico CA and trying to register a Google Titan key: ``` $ tsh mfa add --type u2f --name test && tsh mfa rm test Tap any *registered* security key Tap your *new* security key ERROR: rpc error: code = InvalidArgument desc = U2F device attestation certificate is signed by "CN=Security Key,O=Google", but this cluster only accepts certificates from ["CN=Yubico U2F Root CA Serial 457200631"]; make sure you're using a U2F device from a trusted manufacturer ```