Klas Lindfors
47 lines
1.3 KiB
Plaintext
47 lines
1.3 KiB
Plaintext
Using PIV for SSH through PKCS11
|
|
--------------------------------
|
|
|
|
This is a step-by-step for how to get a Neo with PIV to work for
|
|
public-key authentication with OpenSSH through PKCS11.
|
|
Primarily on a OS X or Linux system.
|
|
|
|
Prerequisites
|
|
-------------
|
|
|
|
* a YubiKey Neo with the PIV applet loaded
|
|
* the yubico-piv-tool software
|
|
* the OpenSC software
|
|
|
|
Steps
|
|
-----
|
|
|
|
1. Generate a key in slot 9a (any slot should suffice):
|
|
|
|
$ yubico-piv-tool -s 9a -a generate -o public.pem
|
|
|
|
2. Create a selfsigned certificate for that key:
|
|
|
|
$ yubico-piv-tool -a verify-pin -P 123456 -a selfsign-certificate -s 9a \
|
|
-S "/CN=SSH key/" -i public.pem -o cert.pem
|
|
|
|
3. Load the certificate:
|
|
|
|
$ yubico-piv-tool -a import-certificate -s 9a -i cert.pem
|
|
|
|
4. Find out where OpenSC has installed the pkcs11 module.
|
|
|
|
* For OS X with binary installation this is typically in `/Library/OpenSC/lib/`
|
|
|
|
* For a Debian based system this is typically in `/usr/lib/x86_64-linux-gnu/`
|
|
+
|
|
After this we'll call this location `$OPENSC_LIBS`
|
|
|
|
5. Get the public key in correct format for ssh and add to authorized_keys on
|
|
the target system.
|
|
|
|
$ ssh-keygen -D $OPENSC_LIBS/opensc-pkcs11.so
|
|
|
|
6. Authenticate to the target system using the new key:
|
|
|
|
$ ssh -I $OPENSC_LIBS/opensc-pkcs11.so user@remote.example.com
|