Return to README.smartcard CVS log

Up to [local] / src / usr.bin / ssh

Warn user to remove old applet and keys
Remove warning about using production keys (we now have PIN protection)

How to use smartcards with OpenSSH?

OpenSSH contains experimental support for authentication using
Cyberflex smartcards and TODOS card readers. To enable this you
need to:

(1) enable SMARTCARD support in OpenSSH:

	$ vi /usr/src/usr.bin/ssh/Makefile.inc
	and uncomment
		CFLAGS+=	-DSMARTCARD
		LDADD+=	-lsectok

(2) If you have used a previous version of ssh with your card, you
    must remove the old applet and keys.

	$ sectok
	sectok> login -d
	sectok> junload Ssh.bin
	sectok> delete 0012
	sectok> delete sh
	sectok> quit

(3) load the Java Cardlet to the Cyberflex card and set card passphrase:

	$ sectok
	sectok> login -d
	sectok> jload /usr/libdata/ssh/Ssh.bin
	sectok> setpass
	Enter new AUT0 passphrase: 
	Re-enter passphrase: 
	sectok> quit

	Do not forget the passphrase.  There is no way to
	recover if you do.

	IMPORTANT WARNING: If you attempt to login with the
	wrong passphrase three times in a row, you will
	destroy your card.

(4) load a RSA key to the card:

	$ ssh-keygen -f /path/to/rsakey -U 1
	(where 1 is the reader number, you can also try 0)

	In spite of the name, this does not generate a key.
	It just loads an already existing key on to the card.

(5) tell the ssh client to use the card reader:

	$ ssh -I 1 otherhost

(6) or tell the agent (don't forget to restart) to use the smartcard:

	$ ssh-add -s 1

-markus,
Tue Jul 17 23:54:51 CEST 2001

$OpenBSD: README.smartcard,v 1.7 2002/03/25 16:47:17 rees Exp $