3 ms·

I'm been using a pretty "obscure" fork named PuTTY CAC. The big feature added is that you can use it with a SmartCard including a Yubikey. I know the most popu

I'm been using a pretty "obscure" fork named PuTTY CAC. The big feature added is that you can use it with a SmartCard including a Yubikey. I know the most popular use of Yubikey + SSH is via OpenPGP but it involves a lot of things which are not working very well on Windows (namely GPG4Win, unstable gpg-connect-agent, etc.). With this fork, you just need to install the official Yubikey mini driver to have it work with PuTTY CAC. (You will also need Yubikey Manager to configure your key). Connect your Yubikey, launch PuTTY CAC, look in SSH>Certificate, enable Attempt cert auth, Set CAPI cert (choose your Yubikey cert). It even works through Windows Remote Desktop. https://github.com/NoMoreFood/putty-cac https://github.com/NoMoreFood/putty-cac

m-p-3 7y ago
Thanks, I've been looking into using the former method but that one seems way more reliable.
denton-scratch 7y ago
I haven't used Putty with a smartcard for a while (about a year); but I certainly didn't have to use a fork. The card was a FSF GnuPG card.
- alibert 7y ago
  I don't know, I'm still have a vanilla PuTTY and I can't make it work with my Yubikey (PIV mode). There is no setting or anything related to SmartCard or PIV. I'm no expert on this so I may have missed something.
  - denton-scratch 7y ago
    Ah. It looks like you have to rely on gpg-agent; gpg-agent understands cards (and PIN-entry). PuTTY knows how to talk to gpg-agent (which simply replaces Pageant). Except I remember ending up with multiple copies of gpg-agent running, for no obvious reason (which had to be killed before I could start a session - hmm. Maybe I remember finding this solution annoying). I think support for PIN-entry had its own annoyances. [Note: I haven't tried this at all recently - I just did a quick search to try to refresh my crumbling memory]
boredpenguin 7y ago
When I used Windows, to use an OpenPGP smartcard with SSH I used this smartcard-enabled fork of pageant[0]. According to the page it should also support Yubikeys. The process was: launch sc-pageant.exe, insert smartcard in reader, and ready to connect with any SSH client with agent support. However it is not open source and you have to register your key if you don't want to get an annoying popup from time to time (iirc it was 1€, but you could also email the developer if you were using an OpenPGP card). [0]: https://smartcard-auth.de/download-en.html https://smartcard-auth.de/download-en.html
- alibert 7y ago
  Wow, it's even better! But the licensing is meh. 20 euros for one public key hardcoded to the license...

m-p-3 7y ago

Thanks, I've been looking into using the former method but that one seems way more reliable.

denton-scratch 7y ago

I haven't used Putty with a smartcard for a while (about a year); but I certainly didn't have to use a fork. The card was a FSF GnuPG card.

alibert 7y ago
I don't know, I'm still have a vanilla PuTTY and I can't make it work with my Yubikey (PIV mode). There is no setting or anything related to SmartCard or PIV. I'm no expert on this so I may have missed something.
- denton-scratch 7y ago
  Ah. It looks like you have to rely on gpg-agent; gpg-agent understands cards (and PIN-entry). PuTTY knows how to talk to gpg-agent (which simply replaces Pageant). Except I remember ending up with multiple copies of gpg-agent running, for no obvious reason (which had to be killed before I could start a session - hmm. Maybe I remember finding this solution annoying). I think support for PIN-entry had its own annoyances. [Note: I haven't tried this at all recently - I just did a quick search to try to refresh my crumbling memory]

boredpenguin 7y ago

When I used Windows, to use an OpenPGP smartcard with SSH I used this smartcard-enabled fork of pageant[0]. According to the page it should also support Yubikeys. The process was: launch sc-pageant.exe, insert smartcard in reader, and ready to connect with any SSH client with agent support. However it is not open source and you have to register your key if you don't want to get an annoying popup from time to time (iirc it was 1€, but you could also email the developer if you were using an OpenPGP card). [0]: https://smartcard-auth.de/download-en.html https://smartcard-auth.de/download-en.html

alibert 7y ago
Wow, it's even better! But the licensing is meh. 20 euros for one public key hardcoded to the license...