5

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my webserver using a key stored on my Nitrokey Pro making my keychain more portable and secure in the process.

I followed this guide pretty much step by step but noticed that in the end, I did not need my Nitrokey Pro to be inserted into my computer at all for the authentication to succeed.

I have a feeling that upon exporting my key it somehow got added to my local key storage making the Nitrokey redundant but I am not knowledgable enough about the exact workings to be sure.

Would anyone be able to help me ensure that I can only SSH into my web server while my Nitrokey is inserted into my computer?

Notes:

  • OS: OSX El Capitan 10.11.4
  • Nitrokey Pro
  • Even while the Nitrokey is inserted into my computer it does NOT ask me to enter a pin when I attempt to SSH.
  • OpenSC 0.15.0
  • gpg 2.0.28

I tried removing from ~/.ssh the following:

id.rsa
private_key.pem

after attempting to SSH to my web server again I get:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

I assume this indicates that the SSH session cannot find my key to authenticate with, I checked if my computer was detecting the Nitrokey by running:

gpg --card-status

and received card information like I would expect.

2
  • Is there really nobody who can shed any light on this? I would really like to improve my security practices as best as I can.
    – MSB
    Apr 29, 2016 at 11:24
  • Did you try options suggested by @Jakuje ? Aug 9, 2017 at 22:00

2 Answers 2

3

I have a feeling that upon exporting my key it somehow got added to my local key storage making the NitroKey redundant but I am not knowledgable enough about the exact workings to be sure.

If that was done properly, it should not be possible. If the private key is stored in the "smartcard", it should not be exportable and for every private key operation, you need that card.

I don't have NitroKey and I am not knowledgeable about the nitrokey applications internals so few commands that should bring some more light:

  • Post devbug log of your connection using the key stored on the cards: ssh -vvv server
  • How does the ssh-add -L look like?
  • Can you see the keys in the "smartcard" when running pkcs11-tool --login -O --module /path/to/usr/lib64/pkcs11/opensc-pkcs11.so
2
  • Is that last command really intended for OSX? Aug 9, 2017 at 22:01
  • @JonathanCross you need to adjust the path.
    – Jakuje
    Aug 10, 2017 at 5:32
0

Nitrokey's guide you mention focused specifically on Linux, which can quickly lead to confusion and frustration for Mac users, since it is so close yet so far away from being the same. I'm not familiar with Nitrokey, but anything using the PCKS11 standard should be cross-compatible once you get it working. :-)

For MacOS, you don't actually need to go down the opensc road. Seemingly one of Apple's best kept secrets is that it natively supports PKCS11 on its own, at least under more recent OS releases. (I'm really not sure about El Capitan from five years ago)

So, where you see a reference to opensc, the Mac-native alternative is SmartCardServices. (but, hey, if you need or want opensc, it's a great tool)

Try the MacOS man page for ssh-keychain (online at manpagez.com). You'll find that ssh using SmartCard authentication surpisingly needs only one config line in your ~/.ssh/config file:

PKCS11Provider /usr/lib/ssh-keychain.dylib

The first time I tried ssh-ing into my remote host, it seemed to take a while, but subsequent connections were quick to prompt for my PIN.

The amount of digging to find that one line was certainly non-trivial!


For webcrawlers, because I haven't found them to know these terms are largely synonymous:
SmartCard - AKA: smart card, PIV, CAC

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .