blob: fdf83ecab4c044918bcce6c7a155af5bfec7f660 [file] [log] [blame]
Damien Millerd97c2ce2001-09-18 15:06:21 +10001How to use smartcards with OpenSSH?
2
Damien Millerc18c06e2003-06-10 18:55:22 +10003OpenSSH contains experimental support for authentication using
Damien Millera8e06ce2003-11-21 23:48:55 +11004Cyberflex smartcards and TODOS card readers, in addition to the cards
Damien Miller78f2e5c2003-06-10 21:09:09 +10005with PKCS#15 structure supported by OpenSC. To enable this you
Damien Millerc18c06e2003-06-10 18:55:22 +10006need to:
Damien Miller8124e1a2001-09-25 10:21:28 +10007
Damien Miller78f2e5c2003-06-10 21:09:09 +10008Using libsectok:
Damien Miller8124e1a2001-09-25 10:21:28 +10009
Damien Miller78f2e5c2003-06-10 21:09:09 +100010(1) enable sectok support in OpenSSH:
11
12 $ ./configure --with-sectok
Damien Millerd97c2ce2001-09-18 15:06:21 +100013
Damien Millerc18c06e2003-06-10 18:55:22 +100014(2) If you have used a previous version of ssh with your card, you
15 must remove the old applet and keys.
Damien Millerd97c2ce2001-09-18 15:06:21 +100016
Damien Millerc18c06e2003-06-10 18:55:22 +100017 $ sectok
18 sectok> login -d
19 sectok> junload Ssh.bin
20 sectok> delete 0012
21 sectok> delete sh
22 sectok> quit
Damien Millerd97c2ce2001-09-18 15:06:21 +100023
Damien Millerc18c06e2003-06-10 18:55:22 +100024(3) load the Java Cardlet to the Cyberflex card and set card passphrase:
Damien Millerd97c2ce2001-09-18 15:06:21 +100025
26 $ sectok
27 sectok> login -d
28 sectok> jload /usr/libdata/ssh/Ssh.bin
Damien Millerd97c2ce2001-09-18 15:06:21 +100029 sectok> setpass
Damien Millera8e06ce2003-11-21 23:48:55 +110030 Enter new AUT0 passphrase:
31 Re-enter passphrase:
Damien Millerd97c2ce2001-09-18 15:06:21 +100032 sectok> quit
33
Damien Millerd97c2ce2001-09-18 15:06:21 +100034 Do not forget the passphrase. There is no way to
35 recover if you do.
36
37 IMPORTANT WARNING: If you attempt to login with the
38 wrong passphrase three times in a row, you will
39 destroy your card.
40
Damien Millerc18c06e2003-06-10 18:55:22 +100041(4) load a RSA key to the card:
Damien Millerd97c2ce2001-09-18 15:06:21 +100042
Damien Millerc18c06e2003-06-10 18:55:22 +100043 $ ssh-keygen -f /path/to/rsakey -U 1
44 (where 1 is the reader number, you can also try 0)
Damien Millerd97c2ce2001-09-18 15:06:21 +100045
Damien Millerc18c06e2003-06-10 18:55:22 +100046 In spite of the name, this does not generate a key.
47 It just loads an already existing key on to the card.
Damien Millerd97c2ce2001-09-18 15:06:21 +100048
Damien Miller78f2e5c2003-06-10 21:09:09 +100049(5) Optional: If you don't want to use a card passphrase, change the
Damien Millerc18c06e2003-06-10 18:55:22 +100050 acl on the private key file:
Damien Millerf6195f22002-04-23 22:48:46 +100051
Damien Millerc18c06e2003-06-10 18:55:22 +100052 $ sectok
53 sectok> login -d
Damien Millera8e06ce2003-11-21 23:48:55 +110054 sectok> acl 0012 world: w
55 world: w
56 AUT0: w inval
Damien Millerc18c06e2003-06-10 18:55:22 +100057 sectok> quit
Damien Millerf6195f22002-04-23 22:48:46 +100058
Damien Millerc18c06e2003-06-10 18:55:22 +100059 If you do this, anyone who has access to your card
60 can assume your identity. This is not recommended.
Damien Millerd97c2ce2001-09-18 15:06:21 +100061
Damien Miller78f2e5c2003-06-10 21:09:09 +100062
63Using OpenSC:
64
65(1) install OpenSC:
66
67 Sources and instructions are available from
68 http://www.opensc.org/
69
70(2) enable OpenSC support in OpenSSH:
71
72 $ ./configure --with-opensc[=/path/to/opensc] [options]
73
74(3) load a RSA key to the card:
75
76 Not supported yet.
77
78
79Common operations:
80
81(1) tell the ssh client to use the card reader:
82
83 $ ssh -I 1 otherhost
84
85(2) or tell the agent (don't forget to restart) to use the smartcard:
86
87 $ ssh-add -s 1
88
89
Damien Millerd97c2ce2001-09-18 15:06:21 +100090-markus,
Damien Millerc18c06e2003-06-10 18:55:22 +100091Tue Jul 17 23:54:51 CEST 2001
92
Damien Millera8e06ce2003-11-21 23:48:55 +110093$OpenBSD: README.smartcard,v 1.9 2003/11/21 11:57:02 djm Exp $