Support for RFC 6187 and smartcard authentication in OpenSSH

[Anthony R Fletcher]

On 03 Mar 2012 at 01:19:21, Anamitra Dutta Majumdar wrote:
> Hi Anthony ,
> 
> Thanks for your responses.
> I have initiated a new thread.
> Can you provide me with further details.
> 
> Thanks,
> Anamitra
> 
> 
> 
> Hello Anamitra,
> 
> I suggest you start a new thread on the list but, yes, there is smart
> card authentication support in Fedora using opensc. It's been in Fedora
> for a while.
> 
>         Anthony
> 
> On 02 Mar 2012 at 16:36:51, Anamitra Dutta Majumdar wrote:
> 
>     I am looking for a version of OpenSSH that has support for RFC 6187 and
>     smart card authentication.
>     Is there such a version out there yet.
>     Thanks,
>     Anamitra
> 

OpenSSH has has smart card support since version 5.4. Basically you load
the smart public keys into your ssh-agent via the command

	ssh-add -s <pkcs11-module>

and unload them via

	ssh-add -e <pkcs11-module>

We are using 
	ssh-add -s opensc-pkcs11.so

which means you need to look into installing opensc and
associated packages. off the top of my head, you'll need 
ccid, pcsc-lite-openct and openct.

So you first job is to get the commands 
	piv-tool --serial
	pkcs11-tool

working with your smartcard. Once you have everything working you can
extract the public keys via
	ssh-keygen -D opensc-pkcs11.so

Good luck.

		Anthony