Use safenet etoken with ssh-agent

[Damien Miller]

On Sat, 13 Sep 2014, Benjamin Fras wrote:

> Hi,
> 
> we are using eToken Pro Anywhere to connect with ssh. Basically this is
> working just fine, if you use ssh -I /lib/libeToken.so.8. But I need to be
> able to add the eToken to the ssh-agent due to ForwardAgent-Option. In our
> setup we use ssh-jumphosts from which you can connect to other hosts that are
> isolated from the workstation's network.
> 
> Unfortunately ssh-add -s /lib/libeToken.so.8 does not work. After entering the
> passphrase for PKCS#11, the operation fails with "Could not add card:
> /lib/libeToken.so.8". Is there any option to get mores details from ssh-add? I
> didn't find any debug mode I could turn on.

No, because all of the action happens in ssh-agent. You can run ssh-agent
in debugging mode though:

$ ssh-agent -d
SSH_AUTH_SOCK=/tmp/ssh-w2Q7ZYWsIZR5/agent.30154; export SSH_AUTH_SOCK;
echo Agent pid 30154;
$ env SSH_AUTH_SOCK=/tmp/ssh-w2Q7ZYWsIZR5/agent.30154 \
  ssh-add -s /lib/libeToken.so.8

-d