5

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my webserver using a key stored on my Nitrokey Pro making my keychain more portable and secure in the process.

I followed this guide pretty much step by step but noticed that in the end, I did not need my Nitrokey Pro to be inserted into my computer at all for the authentication to succeed.

I have a feeling that upon exporting my key it somehow got added to my local key storage making the Nitrokey redundant but I am not knowledgable enough about the exact workings to be sure.

Would anyone be able to help me ensure that I can only SSH into my web server while my Nitrokey is inserted into my computer?

Notes:

  • OS: OSX El Capitan 10.11.4
  • Nitrokey Pro
  • Even while the Nitrokey is inserted into my computer it does NOT ask me to enter a pin when I attempt to SSH.
  • OpenSC 0.15.0
  • gpg 2.0.28

I tried removing from ~/.ssh the following:

id.rsa
private_key.pem

after attempting to SSH to my web server again I get:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

I assume this indicates that the SSH session cannot find my key to authenticate with, I checked if my computer was detecting the Nitrokey by running:

gpg --card-status

and received card information like I would expect.

  • Is there really nobody who can shed any light on this? I would really like to improve my security practices as best as I can. – MSB Apr 29 '16 at 11:24
  • Did you try options suggested by @Jakuje ? – Jonathan Cross Aug 9 '17 at 22:00
3

I have a feeling that upon exporting my key it somehow got added to my local key storage making the NitroKey redundant but I am not knowledgable enough about the exact workings to be sure.

If that was done properly, it should not be possible. If the private key is stored in the "smartcard", it should not be exportable and for every private key operation, you need that card.

I don't have NitroKey and I am not knowledgeable about the nitrokey applications internals so few commands that should bring some more light:

  • Post devbug log of your connection using the key stored on the cards: ssh -vvv server
  • How does the ssh-add -L look like?
  • Can you see the keys in the "smartcard" when running pkcs11-tool --login -O --module /path/to/usr/lib64/pkcs11/opensc-pkcs11.so
| improve this answer | |
  • Is that last command really intended for OSX? – Jonathan Cross Aug 9 '17 at 22:01
  • @JonathanCross you need to adjust the path. – Jakuje Aug 10 '17 at 5:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.