PKI and SSH

[Damien Miller]

Gregory Seidman wrote:

> Due to unpleasant (but arguably valid) policy changes at work, any SSH
> server within the work firewall must accept only PKI authentication.
> Unless we can convince the higher-ups otherwise, we will also have to
> use the commercial SSH server within the firewall. Of course, I should
> be able to use whatever client I like. Unfortunately, it is not clear
> that I can get OpenSSH to use PKI authentication. A bit of googling
> turns up a patch, but nothing too certain or clear. Does OpenSSH support
> PKI authentication? If so, how do I use it?

There were patches sent to the list a while ago to add some basic PKI
functionality, for host keys IIRC. They may still apply to current
version. They stalled because of lack of demand and testing.

Roumen Petrov had (has?) a set of patches too.

-d