2

I have two hardware tokens (Thales/Safenet eToken 5110cc) that both contains certificates for various uses.

I'd like to add only one specific certificate to ssh-agent, however I'm struggling to find the correct PKCS11 URI (described in rfc7512)

For test purposes both tokens use the same pin code, as with every try if the pin code is different, the one for which it is incorrect will increment the tentative counter on the token thus ending locking it.

(I'm using ssh-add through p11-kit-proxy.so for now as I've not been able to use directly the pkcs11 uri - not sure if that matters).

Here are the devices/certificates available:

$ p11tool --list-all-certs
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=1234567890ABCDEF;token=foo
pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=ABCDEF1234567890;token=bar

I've tried various simple filters such as 'token', 'serial' as well as the whole path, as well as escaping the ';', to no avail:

$ ssh-add -s /usr/lib/x86_64-linux-gnu/p11-kit-proxy.so pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=1234567890ABCDEF;token=foo

All certificates end up being added to ssh-agent:

$ ssh-add -L
ssh-rsa AAAAB3<snip> foo
ssh-rsa AAAAC5<snip> bar

Is this because of the use of p11-kit-proxy, or something else I've missed?

Improve this question
5
  • I just remembered of unix.se which might be more appropriated for this question. Feel free to flag/move/close if needed.
    – petrus
    Jan 6, 2022 at 21:37
  • How did you 'escape' the semicolon? If it wasn't preceded by backslash or within either kind of quotemarks, then on any Unix shell it terminates the command and the parts to the right of it are treated as new commands (which are shell variable settings that have no relationship to or effect on your ssh-add command).
    – dave_thompson_085
    Jan 6, 2022 at 23:55
  • @dave_thompson_085 yes with a backslash.
    – petrus
    Jan 7, 2022 at 7:21
  • as per /help/on-topic: "Questions about using cryptographic-related software (e.g. GPG) may be a better fit for Super User." and "Using or configuring software/hardware", I'm moving this over unix.se.
    – petrus
    Jan 8, 2022 at 21:56
  • 1
    I’m voting to close this question because I've posted it at unix.se : unix.stackexchange.com/questions/685598/…
    – petrus
    Jan 8, 2022 at 21:57

1 Answer 1

Reset to default
0

I'm having the same issue. In my case it's the YubiKey key attestation certificate that is loaded together with the PIV certificate.

I haven't found a way to e.g. filter URIs with either SSH or p11-kit (p11-kit server can be started with only specific token, but not specific objects on that token).

ssh-add can remove specific keys when given the public key though! So after loading you can use ssh-add -L to list the keys and then remove the ones you don't want. In my case it looks like this:

ssh-add -s /usr/lib/x86_64-linux-gnu/p11-kit-proxy.so
ssh-add -L | grep Attestation | ssh-add -d -

Or reverse it with grep -v and do some xargs magic for multiple removals.

A patch to support PKCS#11 URIs has been ready since 2018, but the last update on the ticket was in November 2020. No clue what the hold-up is.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .