Ssh askpass pkcs11 provider?

Support Network
1

Hi,
got client cert auth working with Chrome (opensc, pcscd), but ssh client fails to prompt for etoken pin? Looks like etoken is requested (led flickering), but no prompt and so ssh user password is prompted instead of etoken pin?
Any idea whats wrong / missing?

2

Hi @pwFoo,

While I have no experience with this, and in fact didn’t even know of this until I read you post, this seems to be your answer:

https://wiki.archlinux.org/title/Smartcards#SafeNet_eToken

Install the sac-coreAUR to pkcs11 library installation.

There’s also instructions to setup:

SafeNet eToken on Google Chrome

But I don’t know anything more. Sorry.

However, I hope it helps!

3

Hi,
thanks! Yes, sac-core (and opensc, pcscd) is installed and works fine. Chrome client cert auth works too.
But ssh logins with smartcard fails. Looks like etoken is addressed, but fails because no pin prompted.

Looks like a askpass ssh package or configuration is missed.

Added provider line to client config to force to the opensc-pkcs11.so file. Token is visible from shell… So I think just pin prompt or some kind of certificate selection (2 certs stored at etoken…) is missing?

Maybe I should also test some clients like remina oder putty instead of just shell ssh cmd.

4

Welp,

Sadly I have to say…

:man_shrugging:

5

Fixed it! Initial all was fine, but during testing changed from libetoken.so to opensc-pkcs11.so, because I thought it would the right one…
No askpass or something else needed because prompt within shell should appear

Use it manually:

ssh -I /usr/lib/pkcs11/libeToken.so user@server

OR forced by client config: ~/.ssh/config

PKCS11Provider /usr/lib/pkcs11/libeToken.so

Now just use ssh user@<server

1 Like
6

There are these :point_down: instructions as well:

# eToken for SSH
ssh-keygen -D libeToken.so.5
ssh -I libeToken.so.5 localhost
sftp -oPKCS11Provider=libeToken.so.5 localhost
	
# eToken for SSH agent
sudo mv /etc/xdg/autostart/gnome-keyring-ssh.desktop /etc/xdg/autostart/gnome-keyring-ssh.desktop.disabled
logout # for restarting ssh-agent
ssh-add ~/.ssh/id_???
ssh-add -s /usr/local/lib/libeToken.so.5
ssh-add -l

From:

7

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.