[kgo]

I didn't realize I was old and cranky...

I've been using gpg-agent with a smartcard for ssh authentication for the past six months or so. It's the way, the truth, and the light.

Real two-factor authentication. The key can't be compromised without trying to physically take apart the chip on the card and somehow access the internals. Three wrong password attempts and the thing locks. Three wrong attempts with the admin unlock code and the card self-destructs. So even if I lose the card or someone jacks it, it can't be brute forced.

(Yes I don't need that level of security, and I'm not even being paranoid; it's just neat. Makes me feel like James Bond or Batman or some shit like that every time I ssh somewhere. Yes I'm that lame... )

And since it's still using a standard RSA key for ssh authentication, I don't need to install anything special like experimental pam modules, on the host machines. Just copy the public key into authorized_keys. That's nice since I don't have full admin rights on a lot of my host machines.

[andrewcooke]

Sounds interesting? Got a reference? Thanks.

[kgo]

There is a howto on the gnupg site, but frankly it's a little out of date. It focuses enough on hardware to scare people away, but these days most readers are libccid compatible, so it's a non issue. Setup is actually pretty simple.

Basically you either get a card and reader:

http://shop.kernelconcepts.de/product_info.php?cPath=1_26&#3...

Or get an all-in-one cryptostick:

http://www.privacyfoundation.de/crypto_stick/crypto_stick_en...

And setup your gpg keys on there, either by generating them directly on the card or transferring existing keys. These are simple commands documented elsewhere. In addition to the normal signing and encryption keys, you also generate an authentication key.

Then 'ssh-add -L' will spit out your public key in ssh format to copy on the host machines as usual.

After that you just make sure that you'll use gpg-agent instead of ssh-agent. The man page for gpg-agent shows you what you'll want to add to .bashrc.

Then when you ssh into a machine, gpg-agent will take over, pop up a little dialog called pinentry, you enter your code, and you're good. When you go to lunch, remove card, and ssh authentication with that key no longer works.

[ciupicri]

What kind of smartcard are you using?