Standard OpenSSH

  • OpenSSH
  • Has support for OpenSC PKCS#15 cards via OpenSC
  • file:///usr/share/doc/openssh-4.3p1/README.smartcard
  • Openssh 4.4p1 built on Mandriva 2006
    • ssh will use a key on a smart card. If the key requires a PIN to read, ssh must be patched with the src/openssh/ask-for-pin.diff patch.
    • ssh-add will prompt for the pin without the patch.
    • ssh and/or ssh-agent must be compiled with smartcard support. The standard distribution will work for the other commands.
    • Using a specially compiled ssh-agent is probably easiest thing to do.
    • use the --with-opensc option on configure
  • The normal openssh used in this example is Mandriva 2006 openssh-4.3p1
  • I do not believe ssh-agent caches the key (it shouldn't be able to). It does cache the PIN. The token must be in the machine to login.
  • Usage 
    # -I specifies the reader to use.
# This version of SSH doesn't have smart card support.
$ ssh -I 0
no support for smartcards.

# -s specifies the card reader
# Here's a host with ssh-agent that does not support smart cards.
$ /usr/bin/ssh-add -s 0
Enter passphrase for smartcard:
SSH_AGENT_FAILURE
Could not add card: 0

##################
# Here are some examples that work
##################

# Start smartcard aware ssh-agent in one terminal
$ ssh-agent -d
SSH_AUTH_SOCK=/tmp/ssh-AySJL13249/agent.13249; export SSH_AUTH_SOCK;
echo Agent pid 13249;

# Set environment in another terminal
SSH_AUTH_SOCK=/tmp/ssh-AySJL13249/agent.13249; export SSH_AUTH_SOCK
# Use ssh-add
$ /usr/bin/ssh-add -s 0
Enter passphrase for smartcard:
Card added: 0


# This is what you see back in the ssh-agent window
$ ssh-agent -d
SSH_AUTH_SOCK=/tmp/ssh-AySJL13249/agent.13249; export SSH_AUTH_SOCK;
echo Agent pid 13249;
debug1: type 20
debug1: sc_get_keys called: id = 0
debug1: sc_read_pubkey() with cert id 45
debug1: fingerprint 1024 f1:4d:6a:9e:c4:32:1b:c3:8b:00:4f:d5:25:fb:4c:2e
debug1: XXX shrink: 3 < 4

# Here is a logon (normal ssh command)
$ ssh -v groupw
OpenSSH_4.4p1, OpenSSL 0.9.7g 11 Apr 2005
debug1: Reading configuration data /home/benchoff/.ssh/config
debug1: Reading configuration data /usr/local/depot/openssh-4.4p1/etc/ssh_config
debug1: Connecting to groupw [2001:468:c80:2102:213:72ff:fe70:683d] port 22.
debug1: Connection established.
debug1: identity file /home/benchoff/.ssh/identity type -1
debug1: identity file /home/benchoff/.ssh/id_rsa type -1
debug1: identity file /home/benchoff/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3
debug1: match: OpenSSH_4.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.4
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'groupw' is known and matches the RSA host key.
debug1: Found key in /home/benchoff/.ssh/known_hosts:33
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: Private Key
debug1: Server accepts key: pkalg ssh-rsa blen 151
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
Last login: Thu Oct 19 16:49:57 2006 from analon.cns.ip6.vt.edu
# You are logged in.

OpenSSH+PKCS#11

OpenSSH+X.509

  • No labels