3 ms·
OpenSSH doesn't do X.509, how would PIV mode or a smartcard help?
by closeparen 6y ago
OpenSSH doesn't do X.509, how would PIV mode or a smartcard help?
- Xylakant 6y agoYubikeys work in PIV mode with openssh, it just requires the necessary module and some invocation dance with ssh-agent https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK... or Filippo Valsordas yubikey-agent https://github.com/FiloSottile/yubikey-agent https://github.com/FiloSottile/yubikey-agent
- knorker 6y agoWhat invocation dance? This works: "ssh -oPKCS11Provider=/path/to/opensc-pkcs11.so user@host.com" Or you place that in your ~/.ssh/config Host * PKCS11Provider /path/to/opensc-pkcs11.so
- knorker 6y agoAnother guide, that doesn't even require yubico's PKCS11 module: https://ruimarinho.gitbooks.io/yubikey-handbook/content/ssh/authenticating-ssh-with-piv-and-pkcs11-client/ https://ruimarinho.gitbooks.io/yubikey-handbook/content/ssh/...