[roxstar]

If you are going to go the terminal way with ssh-agent I highly recommend using keychain (http://www.funtoo.org/en/security/keychain/intro/ ) which is quite easy to setup and use, and much easier than having to do ssh-add and so on every time you want to use a specific key.

[orlandu63]

There also exists the ControlMaster configuration option which treats multiple sessions to the same host as a single connection. With this enabled, you only have to enter your SSH passphrase once per host. Aside from the convenience of not having to repeatedly enter your passphrase, subsequent sessions are initiated much faster (due to not having to renegotiate) and there is (theoretically) less strain put on your network adapter. Note, however, that if there are no active sessions to a host, the connection to that host will be dropped, and you will have to re-enter your passphrase upon reconnection. See the ControlPersist option for dealing with connection persistence.

If you're like me, however, you'll use both keychain and ControlMaster (for the increased negotiation speed) :)

[leif]

Keychain is the best. It also works with gpg-agent, if you're old and cranky enough to still think gpg is worth using.

[kgo]

I didn't realize I was old and cranky...

I've been using gpg-agent with a smartcard for ssh authentication for the past six months or so. It's the way, the truth, and the light.

Real two-factor authentication. The key can't be compromised without trying to physically take apart the chip on the card and somehow access the internals. Three wrong password attempts and the thing locks. Three wrong attempts with the admin unlock code and the card self-destructs. So even if I lose the card or someone jacks it, it can't be brute forced.

(Yes I don't need that level of security, and I'm not even being paranoid; it's just neat. Makes me feel like James Bond or Batman or some shit like that every time I ssh somewhere. Yes I'm that lame... )

And since it's still using a standard RSA key for ssh authentication, I don't need to install anything special like experimental pam modules, on the host machines. Just copy the public key into authorized_keys. That's nice since I don't have full admin rights on a lot of my host machines.

[andrewcooke]

Sounds interesting? Got a reference? Thanks.

[kgo]

There is a howto on the gnupg site, but frankly it's a little out of date. It focuses enough on hardware to scare people away, but these days most readers are libccid compatible, so it's a non issue. Setup is actually pretty simple.

Basically you either get a card and reader:

http://shop.kernelconcepts.de/product_info.php?cPath=1_26&#3...

Or get an all-in-one cryptostick:

http://www.privacyfoundation.de/crypto_stick/crypto_stick_en...

And setup your gpg keys on there, either by generating them directly on the card or transferring existing keys. These are simple commands documented elsewhere. In addition to the normal signing and encryption keys, you also generate an authentication key.

Then 'ssh-add -L' will spit out your public key in ssh format to copy on the host machines as usual.

After that you just make sure that you'll use gpg-agent instead of ssh-agent. The man page for gpg-agent shows you what you'll want to add to .bashrc.

Then when you ssh into a machine, gpg-agent will take over, pop up a little dialog called pinentry, you enter your code, and you're good. When you go to lunch, remove card, and ssh authentication with that key no longer works.

[ciupicri]

What kind of smartcard are you using?