Home » GNU|Linux smartcard logon using PAM-PKCS11

OpenSSH user mapper

Notice these lines in /etc/pam_pkcs11/pam_pkcs11.conf:

# Search public keys from $HOME/.ssh/authorized_keys to match users
mapper openssh {
debug = true;
module = /lib/pam_pkcs11/openssh_mapper.so;
}

Edit /etc/pam_pkcs11/pam_pkcs11.conf and add OpenSSH mapper:

use_mappers = openssh, null;

Query the RSA public keys on your card :

$ pkcs15-tool --list-public-keys
Using reader with a card: Feitian SCR301 01 00
Public RSA Key [Private Key]
Com. Flags : 2
Usage : [0x4], sign
Access Flags: [0x0]
ModLength : 2048
Key ref : 0
Native : no
Path : 3f0050153000
Auth ID :
ID : c6f280080fb0ed1ebff0480a01d00a98a1b3b89a

In the example, we have one public key with ID c6f280080fb0ed1ebff0480a01d00a98a1b3b89a.

Now, extract and copy the RSA public key to ~/.ssh/authorized_keys:

$pkcs15-tool --read-ssh-key c6f280080fb0ed1ebff0480a01d00a98a1b3b89a -o ~/.ssh/authorized_keys
Using reader with a card: Feitian SCR301 01 00
Please enter PIN [User PIN]:

Testing single sign-on logon (sso)

Now, you should be able to logon using your smartcard:

$ su foo
Please insert your Smart card or enter your username.
Found the Smart card.
Welcome François Pérou (User PIN)!
Smart card PIN: ******
DEBUG:openssh_mapper.c:387: OpenSSH mapper started. debug: 1, mapfile: /etc/pam_pkcs11/authorized_keys
Bookmark/Search this post with