Hacker News new | past | comments | ask | show | jobs | submit login

Most likely will depend on what smartcard you get but here is how I do it with my Gemalto card:

I use the Minidriver manager tool from: http://www.gemalto.com/products/dotnet_card/resources/develo... although you could use something like pkcs11-tool.

Generating a RSA keypair is as simple as right clicking on an empty container, selecting OBKG Container and filling this out:

http://i.imgur.com/uMY53OD.png

It will display the public key but it is in hex and uses Microsoft's PublicKeyBlob structure. OpenSSL will convert this to PEM for you though, which is what you want for SSH authentication. Something like:

    openssl rsa -pubin -inform MSPUBLICKEYBLOB -in "C:\path\to\my\publickey" -outform PEM -out "C:\path\to\my\publickey.pem"
Open this new file in a text editor and get rid of the begin and end public key lines and just smack it all on one line with "ssh-rsa " (note the space) in front of it. You can then add this to your server's authorized_keys file.

OpenSSH can use a pkcs11 library for authentication (-I option), which is also avaliable from Gemalto's website (these are generally specific to the smartcard), and on Windows there is a version of PuTTY called PuTTY SC that will also let you use the pkcs11 library.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: