Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation:
My desktop computer with smartcard has a ssh session to shell.provider.com. From shell.provider.com I have a ssh session to shell.provider2.com (I sometimes call this situation 'hopping over')
My smartcard is inserted in the desktop computer. Is it (in any way) possible to use smartcard authentication to login to shell.provider2.com?
You can use ssh-agent to add a smart card and then forward agent to the other host. This will let you authenticate on the second host from the first using your local smartcard. In short:
eval `ssh-agent` # if the agent is not running yet
ssh-add -s /path/to/pkcs11.so # probably /usr/lib64/opensc-pkcs11.so
# or Ubuntu: /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so
# enter your pin
ssh-add -l # should list your smartcard
ssh -A shell.provider.com # should not prompt for pin
ssh shell.provider2.com # from the shell.provider.com
-A switch. The last command is not run on the desktop, but on the first shell
/usr/lib/ssh-keychain.dylib on linux, but ssh'ing on linux shows errors retrieving the keys: pkcs11_add_provider: provider /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so returned no slots
Solutions for a smartcard can be
You could use a dedicated configuration for this in ~/.ssh/config by using a configuration for host B, or use it as a parameter in an ssh invocation.
Host B
Hostname <the-real-hostname-for-B>
User <user>
Port 22
ProxyCommand ssh -p 22 -q -W %h:%p <the-real-hostname-for-A>
an advantage is that you will have an alias for the host and also have code completion (less typing)
ssh <user>@B
TAKE CARE: agent forwarding is a bad practice on a shared machine, since it is extremely easy to hijack your agent via the environment variable SSH_AUTH_SOCK so that an attacker can take over your identity AND authentication mechanism to hop to other hosts.
When using yubikeys as your smartcard, you can use the feature that you need to physically touch your smartcard when a cryptographic operation is required like logging in. this way, the attacker also needs physical acccess to your smartcard, twharting the attack in most cases.
