How to use a YubiKey for SSH on Android with TermBot (F-Droid, OpenPGP security key)

[isscbta]

This is the simplest way I’ve found to use a YubiKey for SSH on Android, without Termux, OpenKeychain, or OkcAgent.
TermBot can use your YubiKey directly as an OpenPGP security key and authenticate over SSH.

What you need

• Android phone
• A YubiKey (NFC or USB + OTG adapter)
• TermBot installed from F-Droid
• Your YubiKey SSH public key already added on the server in

  Code: Select all

  ~/.ssh/authorized_keys

Step 1: Install TermBot via F-Droid

1. Install F-Droid.
2. Open F-Droid and install TermBot.

Step 2: Add your YubiKey in TermBot

1. Open TermBot.
2. Go to: Settings -> Manage Pubkeys
3. Tap the + button (top-right).
4. Select: Add OpenPGP security key
5. Tap your YubiKey (NFC) or plug it in via USB/OTG.
6. Enter your YubiKey PIN when prompted.

After this, TermBot will save your YubiKey as an SSH key option you can assign to hosts.

Step 3: Create (or edit) the SSH host and use the YubiKey

1. In TermBot, add a new host (or edit an existing one).
2. Set:
   • Host (IP or domain)
   • Port (usually 22)
   • Username (e.g. root, admin, etc.)
3. In the authentication/key option, choose the YubiKey you added in Step 2.
4. Save, then connect.

When you connect, TermBot may prompt you for the YubiKey PIN and you may need to tap/keep the key present (NFC or USB).

Server-side requirement (very important)
Your SSH public key from the YubiKey must exist on the server in:

Code: Select all

~/.ssh/authorized_keys

Troubleshooting: “Permission denied (publickey)”
If you get this error, check:

• You are connecting with the correct username.
• The correct YubiKey public key is actually present in

  Code: Select all

  authorized_keys

  .
• You selected the correct key in TermBot (if you have multiple keys/subkeys).

• Code: Select all

  ~/.ssh

  and

  Code: Select all

  authorized_keys

  permissions are correct (see above).

Done
That’s it. Install F-Droid -> install TermBot -> add OpenPGP security key -> assign it to the host -> connect.