lrnz.name

User Tools

Site Tools

Trace: • dokuwiki • playground • python • ssh
infrastructure:ssh

This is an old revision of the document!

SSH

SSH and SCP on Windows with smartcard authentication

  • Get pageant from putty-cac
  • Import a smartcart certificate
    • Run pageant.exe
    • Right click pageant try icon
    • Add CAPI cert
    • Choose certificate
  • Automatically import a smartcard certificate:
    • Get fingerprint from certificate
      • certmgr.msc
      • Browse to certificate, e.g. “Personal/Certificates” (“Eigene Zertifikate/Zertifikate”)
      • Open certificate by double-clicking or right-click and “Open”
      • “Details | Thumbprint” (“Fingerabdruck”)
      • Copy fingerprint and remove the spaces
    • Run: pageant.exe CAPI:{fingerprint}
  • PuTTY using smartcard authentication
    • Ensure that pageant.exe is still running in the system tray
    • Run Putty
    • Connection | SSH | Auth | [x] Attempt authencation using Pageant
    • Optionally disable “Attempt keyboard-interactive auth (SSH-2)” to prevent a password login and force the smartcard use
    • Optionally enable “Allow agent forwarding” to enable further logins via smartcard authentication
  • PLink using smartcard authentication
    • Ensure that pageant.exe is still running in the system tray
    • plink.exe -agent user@host
    • Optioanlly use -A for agent forwarding
  • WinSCP using smartcard authentication:
    • Ensure that pageant.exe is still running in the system tray
    • Advanced settings | SSH | Authentication | [x] Try authentation using Pageant
    • Optionally disable “Attempt keyboard-interactive Authentication” to prevent a password login and force the smartcard use

Converting X509 certificate to SSH public key

  • Export in Windows
    • certmgr.msc
    • Browse to certificate
    • Open certificate by double-clicking or right-click and “Open”
    • Details
    • Export to file
    • (*) No, don't export private key
    • (*) Base-64 encoded X.509 (.CER)
  • Run: openssl x509 -in certificate.cer -pubkey -noout > certificate.pem
  • Run: ssh-keygen -i -m PKCS8 -f certificate.pem
  • The SSH key is displayed

Using Pageant with SSH in Cygwin and MinGW

  • Get ssh-pageant.exe from ssh-pageant
  • Cygwin
    • Install in Cygwin (do not copy paste the file via Windows Explorer)
      • $ cp ssh-pageant.exe /usr/bin/
      • $ chmod 755 /usr/bin/ssh-pageant.exe
    • Run ssh-pageant: $ eval $(/usr/bin/ssh-pageant -r -a “/tmp/.ssh-pageant-$USERNAME”)
    • Automatically run ssh-pageant: Add the eval command to ~/.bashrc or ~/.bash_profile
    • Alternatively, read the long description
  • MinGW
    • $ eval $(<path-to>/ssh-pageant.exe -r -a “/tmp/.ssh-pageant-$USERNAME”)

SSH Tunneling

  • Create an SSH tunnel from localhost:1234 through jump-server:2233 to remote-host:22
    • $ ssh -L 1234:remote-host:22 -p 2233 user@jump-server
    • $ plink -L 1234:remote-host:22 -P 2233 user@jump-server
  • Use a different known hosts file when creating multiple tunnels: $ ssh -o UserKnownHostsFile=~/.ssh/known_hosts_tunnel_remote-host -L 1234:remote-host:22 -p 2233 user@jump-server
infrastructure/ssh.1531994477.txt.gz · Last modified: (external edit)