Damien Miller | d97c2ce | 2001-09-18 15:06:21 +1000 | [diff] [blame] | 1 | How to use smartcards with OpenSSH? |
| 2 | |
| 3 | OpenSSH contains experimental support for authentication using |
Ben Lindstrom | 34b7320 | 2002-04-08 18:37:07 +0000 | [diff] [blame] | 4 | Cyberflex smartcards and TODOS card readers, in addition to the cards with |
| 5 | PKCS #15 structure supported by OpenSC. |
Damien Miller | 8124e1a | 2001-09-25 10:21:28 +1000 | [diff] [blame] | 6 | |
| 7 | WARNING: Smartcard support is still in development. Keyfile formats, etc |
| 8 | are still subject to change. |
| 9 | |
| 10 | To enable this you need to: |
Damien Miller | d97c2ce | 2001-09-18 15:06:21 +1000 | [diff] [blame] | 11 | |
Ben Lindstrom | 34b7320 | 2002-04-08 18:37:07 +0000 | [diff] [blame] | 12 | (1) install sectok or OpenSC |
Damien Miller | d97c2ce | 2001-09-18 15:06:21 +1000 | [diff] [blame] | 13 | |
Damien Miller | 7a62b77 | 2001-09-18 15:44:34 +1000 | [diff] [blame] | 14 | Sources are instructions are available from |
| 15 | http://www.citi.umich.edu/projects/smartcard/sectok.html |
Damien Miller | d97c2ce | 2001-09-18 15:06:21 +1000 | [diff] [blame] | 16 | |
Ben Lindstrom | a42694f | 2002-04-05 16:11:45 +0000 | [diff] [blame] | 17 | or |
| 18 | |
| 19 | http://www.opensc.org/ |
| 20 | |
Damien Miller | d97c2ce | 2001-09-18 15:06:21 +1000 | [diff] [blame] | 21 | (2) enable SMARTCARD support in OpenSSH: |
| 22 | |
Ben Lindstrom | a42694f | 2002-04-05 16:11:45 +0000 | [diff] [blame] | 23 | $ ./configure --with-sectok[=/path/to/libsectok] [options] |
Damien Miller | 7a62b77 | 2001-09-18 15:44:34 +1000 | [diff] [blame] | 24 | |
Ben Lindstrom | a42694f | 2002-04-05 16:11:45 +0000 | [diff] [blame] | 25 | or |
Damien Miller | 7a62b77 | 2001-09-18 15:44:34 +1000 | [diff] [blame] | 26 | |
Ben Lindstrom | a42694f | 2002-04-05 16:11:45 +0000 | [diff] [blame] | 27 | $ ./configure --with-opensc[=/path/to/opensc] [options] |
Damien Miller | d97c2ce | 2001-09-18 15:06:21 +1000 | [diff] [blame] | 28 | |
| 29 | (3) load the Java Cardlet to the Cyberflex card: |
| 30 | |
| 31 | $ sectok |
| 32 | sectok> login -d |
| 33 | sectok> jload /usr/libdata/ssh/Ssh.bin |
| 34 | sectok> quit |
| 35 | |
| 36 | (4) load a RSA key to the card: |
| 37 | |
| 38 | please don't use your production RSA keys, since |
| 39 | with the current version of sectok/ssh-keygen |
| 40 | the private key file is still readable |
| 41 | |
| 42 | $ ssh-keygen -f /path/to/rsakey -U 1 |
| 43 | (where 1 is the reader number, you can also try 0) |
| 44 | |
| 45 | In spite of the name, this does not generate a key. |
| 46 | It just loads an already existing key on to the card. |
| 47 | |
| 48 | (5) optional: |
| 49 | |
| 50 | Change the card password so that only you can |
| 51 | read the private key: |
| 52 | |
| 53 | $ sectok |
| 54 | sectok> login -d |
| 55 | sectok> setpass |
| 56 | sectok> quit |
| 57 | |
| 58 | This prevents reading the key but not use of the |
| 59 | key by the card applet. |
| 60 | |
| 61 | Do not forget the passphrase. There is no way to |
| 62 | recover if you do. |
| 63 | |
| 64 | IMPORTANT WARNING: If you attempt to login with the |
| 65 | wrong passphrase three times in a row, you will |
| 66 | destroy your card. |
| 67 | |
| 68 | (6) tell the ssh client to use the card reader: |
| 69 | |
| 70 | $ ssh -I 1 otherhost |
| 71 | |
| 72 | (7) or tell the agent (don't forget to restart) to use the smartcard: |
| 73 | |
| 74 | $ ssh-add -s 1 |
| 75 | |
| 76 | -markus, |
| 77 | Tue Jul 17 23:54:51 CEST 2001 |