SSH

In case there is no authorized_keys file yet, create one:

• mkdir ~/.ssh
• nano ~/.ssh/authorized_keys
• Paste the public key to the file

Set the permissions for the .ssh folder and the authorized_keys file:

• chmod 700 ~/.ssh
• chmod 600 ~/.ssh/authorized_keys

• Get pageant from putty-cac
• Import a smartcart certificate
  • Run pageant.exe
  • Right click pageant try icon
  • Add CAPI cert
  • Choose certificate
• Automatically import a smartcard certificate:
  • Get fingerprint from certificate
    • certmgr.msc
    • Browse to certificate, e.g. “Personal/Certificates” (“Eigene Zertifikate/Zertifikate”)
    • Open certificate by double-clicking or right-click and “Open”
    • “Details | Thumbprint” (“Fingerabdruck”)
    • Copy fingerprint and remove the spaces
  • Run: pageant.exe CAPI:{fingerprint}
• PuTTY using smartcard authentication
  • Ensure that pageant.exe is still running in the system tray
  • Run Putty
  • Connection | SSH | Auth | [x] Attempt authencation using Pageant
  • Optionally disable “Attempt keyboard-interactive auth (SSH-2)” to prevent a password login and force the smartcard use
  • Optionally enable “Allow agent forwarding” to enable further logins via smartcard authentication
• PLink using smartcard authentication
  • Ensure that pageant.exe is still running in the system tray
  • plink.exe -agent user@host
  • Optioanlly use -A for agent forwarding
• WinSCP using smartcard authentication:
  • Ensure that pageant.exe is still running in the system tray
  • Advanced settings | SSH | Authentication | [x] Try authentation using Pageant
  • Optionally disable “Attempt keyboard-interactive Authentication” to prevent a password login and force the smartcard use

• Using OpenSSL
  • Export in Windows
    • certmgr.msc
    • Browse to certificate
    • Open certificate by double-clicking or right-click and “Open”
    • Details
    • Export to file
    • (*) No, don't export private key
    • (*) Base-64 encoded X.509 (.CER)
  • Run: openssl x509 -in certificate.cer -pubkey -noout > certificate.pem
  • Run: ssh-keygen -i -m PKCS8 -f certificate.pem
  • The SSH key is displayed
• Using PuTTY-CAC
  • Open PuTTY-CAC
  • Connection > SSH > Certificate > Set CAPI Cert…
  • Certificate string for authorized keys file: Copy to Clipboard

• Get ssh-pageant.exe from ssh-pageant
• Cygwin
  • Install in Cygwin (do not copy paste the file via Windows Explorer)
    • $ cp ssh-pageant.exe /usr/bin/
    • $ chmod 755 /usr/bin/ssh-pageant.exe
  • Run ssh-pageant: $ eval $(/usr/bin/ssh-pageant -r -a “/tmp/.ssh-pageant-$USERNAME”)
  • Automatically run ssh-pageant: Add the eval command to ~/.bashrc or ~/.bash_profile
  • Alternatively, read the long description
• MinGW
  • $ eval $(<path-to>/ssh-pageant.exe -r -a “/tmp/.ssh-pageant-$USERNAME”)

• $ ssh -o ProxyCommand='ncat –proxy-type http –proxy proxy-server:proxy-port –proxy-auth proxy-user:proxy-password %h %p' remote-host
• ncat is part of nmap

• Create an SSH tunnel from localhost:1234 through jump-server:2233 to remote-host:22
  • $ ssh -L 1234:remote-host:22 -p 2233 user@jump-server
  • $ plink -L 1234:remote-host:22 -P 2233 user@jump-server
• Use a different known hosts file when creating multiple tunnels: $ ssh -o UserKnownHostsFile=~/.ssh/known_hosts_tunnel_remote-host -L 1234:remote-host:22 -p 2233 user@jump-server
• SSH into remote-user@remote-host behind jump-user@jump-server: $ ssh -J jump-user@jump-server remote-user@remote-host

SSH config with jump server:

# SSH into remote-user@remote-host behind jump-user@jump-server
Host my-remote
    ForwardAgend yes
    Hostname remote-host
    User remote-user
    ProxyJump jump-user@jump-server