[FC8] ssh and CAC card???

[Todd Denniston]

Todd Denniston wrote, On 12/04/2007 04:52 PM:
>  From what I understood, the change to openssh listed in:
>  rpm -q --changelog  openssh  |less
> as:
> "* Wed Jun 20 2007 Tomas Mraz <tmraz at redhat.com> - 4.5p1-7
> - experimental NSS keys support
> - correctly setup context when empty level requested (#234951)
> "
> was supposed to allow the Common Access Card (CAC) to work with the 
> shipped Fedora 8 ssh.
> 
> As per NSS usual, everything is undocumented, i.e., `ssh-add --help` 
> does not help at all, and `man ssh-add` points to `ssh-add -s reader`
> # ssh-add -s 0
> Enter passphrase for smartcard:
> SSH_AGENT_FAILURE
> Could not add card: 0
> # ssh-add -s 1
> Enter passphrase for smartcard:
> SSH_AGENT_FAILURE
> Could not add card: 1
> 
> So does anyone know how to use the possible functionality, or are we 
> reduced to reading the source?
> 

After a bit of RTFS, I found README.nss which is installed to 
/usr/share/doc/openssh-4.7p1/ in FC8.

Trying to use the info in that document gets me:
# ssh -o 'UseNSS yes' otherhost
Failed to initialize NSS library
Permission denied (publickey,keyboard-interactive).
# ssh-add -n
Failed to initialize NSS library
# ssh-keygen -n
Failed to initialize NSS library
cannot find public key in NSS

no idea what
'NSS Token My PKCS11 Token'
'My PKCS11 Token'
or 'My Key ID' are supposed to be set to (how do I match that up with "use the 
cac card" or "my common name is"?).


drop back and punt[1] has been called.
[1] https://bugzilla.redhat.com/show_bug.cgi?id=186469#c8
-- 
Todd Denniston
Crane Division, Naval Surface Warfare Center (NSWC Crane)
Harnessing the Power of Technology for the Warfighter