Support for RFC 6187 and smartcard authentication in OpenSSH

[Anamitra Dutta Majumdar]

Hi Anthony ,

Thanks for your responses.
I have initiated a new thread.
Can you provide me with further details.

Thanks,
Anamitra

Hello Anamitra,

I suggest you start a new thread on the list but, yes, there is smart
card authentication support in Fedora using opensc. It's been in Fedora
for a while.

Anthony

On 02 Mar 2012 at 16:36:51, Anamitra Dutta Majumdar wrote:
> I am looking for a version of OpenSSH that has support for RFC 6187 and
> smart card authentication.
> Is there such a version out there yet.
> Thanks,
> Anamitra

[Anthony R Fletcher]

On 03 Mar 2012 at 01:19:21, Anamitra Dutta Majumdar wrote:
> Hi Anthony ,
>
> Thanks for your responses.
> I have initiated a new thread.
> Can you provide me with further details.
>
> Thanks,
> Anamitra
>
> Hello Anamitra,
>
> I suggest you start a new thread on the list but, yes, there is smart
> card authentication support in Fedora using opensc. It's been in Fedora
> for a while.
>     Anthony
>
> On 02 Mar 2012 at 16:36:51, Anamitra Dutta Majumdar wrote:
> I am looking for a version of OpenSSH that has support for RFC 6187 and
> smart card authentication.
> Is there such a version out there yet.
> Thanks,
> Anamitra

OpenSSH has has smart card support since version 5.4. Basically you load
the smart public keys into your ssh-agent via the command

ssh-add -s <pkcs11-module>

and unload them via

ssh-add -e <pkcs11-module>

We are using 
    ssh-add -s opensc-pkcs11.so

which means you need to look into installing opensc and
associated packages. off the top of my head, you'll need 
ccid, pcsc-lite-openct and openct.

So you first job is to get the commands 
    piv-tool --serial
    pkcs11-tool

working with your smartcard. Once you have everything working you can
extract the public keys via
    ssh-keygen -D opensc-pkcs11.so

Good luck.

Anthony

[Anamitra Dutta Majumdar]

Hi Anthony,

Thanks for the response. That would be helpful.
Do you happen to know about the support for RFC 6187.

Thanks
Anamitra

On 3/3/12 7:18 AM, "Anthony R Fletcher"  wrote:
> On 03 Mar 2012 at 01:19:21, Anamitra Dutta Majumdar wrote:
> > Hi Anthony ,
> >
> > Thanks for your responses.
> > I have initiated a new thread.
> > Can you provide me with further details.
> >
> > Thanks,
> > Anamitra
> >
> > Hello Anamitra,
> >
> > I suggest you start a new thread on the list but, yes, there is smart
> > card authentication support in Fedora using opensc. It's been in Fedora
> > for a while.
> >     Anthony
> >
> > On 02 Mar 2012 at 16:36:51, Anamitra Dutta Majumdar wrote:
> > I am looking for a version of OpenSSH that has support for RFC 6187
> >
> > and
> >     smart card authentication.
> >     Is there such a version out there yet.
> >     Thanks,
> >     Anamitra
>
> OpenSSH has has smart card support since version 5.4. Basically you load
> the smart public keys into your ssh-agent via the command
>
> ssh-add -s <pkcs11-module>
>
> and unload them via
>
> ssh-add -e <pkcs11-module>
>
> We are using 
>    ssh-add -s opensc-pkcs11.so
>
> which means you need to look into installing opensc and
> associated packages. off the top of my head, you'll need
> ccid, pcsc-lite-openct and openct.
>
> So you first job is to get the commands
>    piv-tool --serial
>    pkcs11-tool
>
> working with your smartcard. Once you have everything working you can
> extract the public keys via
>    ssh-keygen -D opensc-pkcs11.so
>
> Good luck.
>    Anthony
>
> -- 
> users mailing list
> [e-mail]
> To unsubscribe or change subscription options:
> https://admin.fedoraproject.org/mailman/listinfo/users
> Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
> Have a question? Ask away: http://ask.fedoraproject.org