0

I'm trying to setup SSH authentication with smart card reader in a clean Ubuntu 22.04 install. When ssh it doesn't try to authenticate using smart card reader but it just says "[email protected]: permission denied (publickey)."

Gpg-agent works for signing and decrypting with SC but it doesn't work for SSH authentication. I've set enable-ssh-support flag in .gnupg/gpg-agent.conf but it doesn't work like it used to work in my old Ubuntu 16.04.

Also from https://unix.stackexchange.com/questions/701131/use-ntrux25519-key-exchange-with-gpg-agent I've tried setting "KexAlgorithms [email protected]" option in client ~/.ssh/congig, in server /etc/ssh/sshd_config and in both with no luck.

Also I tried setting "PKCS11Provider /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so" option in .ssh/config, but I'm not sure if this option is for other type of card but gnupg.

These commands were executed initially:

$ sudo apt install gnupg2 gnupg-agent pcscd scdaemon pcsc-tools opensc gpgsm
$ sudo mv /etc/xdg/autostart/gnome-keyring-ssh.desktop /etc/xdg/autostart/gnome-keyring-ssh.desktop.inactive
$ echo "enable-ssh-support" >> ~/.gnupg/gpg-agent.conf
$ gpg2 --import public-armored-stub.gpg
$ gpg2 --edit-key <mykey>
    gpg> trust
    Your decision? 5
    Do you really want to set this key to ultimate trust? (y/N) y
    gpg> quit

Appart, if I plug the reader (with same SC) to my old laptop with Ubuntu 16.04 it works perfectly even without installing drivers from Identiv website. I'm using Identiv card reader (SCM SPR332 V2 - Pinpad Reader) with a gnupg v2.1 SC on Ubuntu 22.04. Any idea on what is left?

Improve this question

1 Answer 1

Reset to default
0

Finally for setting up SSH authentication with smart card in Ubuntu 22.04 just 2 more config files were to be edited compared with older versions. I found info here.

Appart, there was no need to edit Gnome keyring autostart files and also no drivers were needed, at least for Nitrokey Pro and Identiv SCM SPR332 V2 Pinpad Reader. However a Cherry keyboard with SC reader (KC 1000 SC) was not running with this procedure.

I also found that only scdaemon package needed to be installed. All this was tested in another fresh install.

Setup:

$ sudo apt install scdaemon
$ echo "use-agent" >> ~/.gnupg/gpg.conf
$ echo "enable-ssh-support" >> ~/.gnupg/gpg-agent.conf
$ echo "IdentityAgent /run/user/1000/gnupg/S.gpg-agent.ssh" >> ~/.ssh/config

Addind public keys stubs to keyring:

$ gpg2 --import public-armored-stub.gpg
$ gpg2 --edit-key <mykey>
    gpg> trust
    Your decision? 5
    Do you really want to set this key to ultimate trust? (y/N) y
    gpg> quit

In my case public SSH keys on server were already at ~/.ssh/authorized_keys.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .