Support for RFC 6187 and smartcard authentication in OpenSSH
Anamitra Dutta Majumdar
anmajumd at cisco.com
Sat Mar 3 18:04:34 UTC 2012
Hi Anthony,
Thanks for the response. That would be helpful.
Do you happen to know about the support for RFC 6187.
Thanks
Anamitra
On 3/3/12 7:18 AM, "Anthony R Fletcher" <arif at mail.nih.gov> wrote:
>
>On 03 Mar 2012 at 01:19:21, Anamitra Dutta Majumdar wrote:
>> Hi Anthony ,
>>
>> Thanks for your responses.
>> I have initiated a new thread.
>> Can you provide me with further details.
>>
>> Thanks,
>> Anamitra
>>
>>
>>
>> Hello Anamitra,
>>
>> I suggest you start a new thread on the list but, yes, there is smart
>> card authentication support in Fedora using opensc. It's been in Fedora
>> for a while.
>>
>> Anthony
>>
>> On 02 Mar 2012 at 16:36:51, Anamitra Dutta Majumdar wrote:
>>
>> I am looking for a version of OpenSSH that has support for RFC 6187
>>and
>> smart card authentication.
>> Is there such a version out there yet.
>> Thanks,
>> Anamitra
>>
>
>OpenSSH has has smart card support since version 5.4. Basically you load
>the smart public keys into your ssh-agent via the command
>
> ssh-add -s <pkcs11-module>
>
>and unload them via
>
> ssh-add -e <pkcs11-module>
>
>We are using
> ssh-add -s opensc-pkcs11.so
>
>which means you need to look into installing opensc and
>associated packages. off the top of my head, you'll need
>ccid, pcsc-lite-openct and openct.
>
>So you first job is to get the commands
> piv-tool --serial
> pkcs11-tool
>
>working with your smartcard. Once you have everything working you can
>extract the public keys via
> ssh-keygen -D opensc-pkcs11.so
>
>Good luck.
>
> Anthony
>
>--
>users mailing list
>users at lists.fedoraproject.org
>To unsubscribe or change subscription options:
>https://admin.fedoraproject.org/mailman/listinfo/users
>Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>Have a question? Ask away: http://ask.fedoraproject.org
More information about the users
mailing list