summaryrefslogtreecommitdiff
path: root/README.smartcard
diff options
context:
space:
mode:
Diffstat (limited to 'README.smartcard')
-rw-r--r--README.smartcard93
1 files changed, 0 insertions, 93 deletions
diff --git a/README.smartcard b/README.smartcard
deleted file mode 100644
index fdf83ecab..000000000
--- a/README.smartcard
+++ /dev/null
@@ -1,93 +0,0 @@
1How to use smartcards with OpenSSH?
2
3OpenSSH contains experimental support for authentication using
4Cyberflex smartcards and TODOS card readers, in addition to the cards
5with PKCS#15 structure supported by OpenSC. To enable this you
6need to:
7
8Using libsectok:
9
10(1) enable sectok support in OpenSSH:
11
12 $ ./configure --with-sectok
13
14(2) If you have used a previous version of ssh with your card, you
15 must remove the old applet and keys.
16
17 $ sectok
18 sectok> login -d
19 sectok> junload Ssh.bin
20 sectok> delete 0012
21 sectok> delete sh
22 sectok> quit
23
24(3) load the Java Cardlet to the Cyberflex card and set card passphrase:
25
26 $ sectok
27 sectok> login -d
28 sectok> jload /usr/libdata/ssh/Ssh.bin
29 sectok> setpass
30 Enter new AUT0 passphrase:
31 Re-enter passphrase:
32 sectok> quit
33
34 Do not forget the passphrase. There is no way to
35 recover if you do.
36
37 IMPORTANT WARNING: If you attempt to login with the
38 wrong passphrase three times in a row, you will
39 destroy your card.
40
41(4) load a RSA key to the card:
42
43 $ ssh-keygen -f /path/to/rsakey -U 1
44 (where 1 is the reader number, you can also try 0)
45
46 In spite of the name, this does not generate a key.
47 It just loads an already existing key on to the card.
48
49(5) Optional: If you don't want to use a card passphrase, change the
50 acl on the private key file:
51
52 $ sectok
53 sectok> login -d
54 sectok> acl 0012 world: w
55 world: w
56 AUT0: w inval
57 sectok> quit
58
59 If you do this, anyone who has access to your card
60 can assume your identity. This is not recommended.
61
62
63Using OpenSC:
64
65(1) install OpenSC:
66
67 Sources and instructions are available from
68 http://www.opensc.org/
69
70(2) enable OpenSC support in OpenSSH:
71
72 $ ./configure --with-opensc[=/path/to/opensc] [options]
73
74(3) load a RSA key to the card:
75
76 Not supported yet.
77
78
79Common operations:
80
81(1) tell the ssh client to use the card reader:
82
83 $ ssh -I 1 otherhost
84
85(2) or tell the agent (don't forget to restart) to use the smartcard:
86
87 $ ssh-add -s 1
88
89
90-markus,
91Tue Jul 17 23:54:51 CEST 2001
92
93$OpenBSD: README.smartcard,v 1.9 2003/11/21 11:57:02 djm Exp $