ssh-keygen support for ssh-agent

[Damien Miller]

Agent support for ssh-keygen isn't a bad idea - could you please
file a feature request at https://bugzilla.mindrot.org/ so we don't
forget it?

-d

On Fri, 10 Apr 2015, Boles?aw Tokarski wrote:

> Hello,
> 
> I am in a PoC of setting up a SSH CA for the SSH host keys. The idea is to
> add an SSH CA service that would generate SSH certificates for servers that
> we install automatically. This way, we would be sure that if a server
> presents itself with a certificate signed with the CA, it belongs to us,
> and is no MitM.
> 
> I settled on a GnuPG smartcard to go with the SSH CA. This would secure the
> private key material from remote attack, and the smartcard itself is
> protected by a PIN. The smartcard is supported by opensc-pkcs11.so, and it
> works nicely with ssh authentication, with native ssh-agent with "ssh-add
> -s opensc-pksc11.so", with gpg-agent's ssh agent support, and it neatly
> generates SSH certificates with "ssh-keygen -D opensc-pkcs11.so".
> 
> Now, my design assumed that the SSH CA would only require PIN entering on
> its PIN-pad after, say, a reboot. ssh-agent works like this for ssh
> authentication - it keeps the card open until it's removed or the machine
> gets turned off. Unfortunately, ssh-keygen cannot currently utilize
> ssh-agent for generating host certificates. It opens the smartcard with the
> pkcs11 library on its own, requests the PIN for every signature, and closes
> the card.
> 
> Of course, I could use a card reader that doesn't have a PIN-pad. I guess I
> could issue "echo 1234 |ssh-keygen -D opensc-pkcs11.so". Or I could totally
> resign from using a smartcard. But then, the same happens if I use a
> password-protected private key as the CA - I get prompted for the key
> password on each run. All of those approaches are not ideal, to say the
> least.
> 
> What I need is a process that keeps the smartcard open, so that it's
> possible to only enter the PIN once. This is done for ssh in ssh-agent.
> Would it be possible to add ssh-agent support to ssh-keygen?
> 
> Best regards,
> Boles?aw Tokarski
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>