GNOME Bugzilla – Bug 535373
Unable to use SmartCard with gnome-keyring for ssh
Last modified: 2018-03-10 08:46:33 UTC
I use a USB token to access many work systems. This is supported by OpenSSH as a build-time option. It provides an interface to OpenSC, the open-source SmartCard support package. gnome-keyring lacks support for SmartCards which use the same software and standards as the USB tokens. (They are effectively a SmartCard and reader in one package.) All code is available in OpenSSH-portable, but you may need to re-write if you need it under GPL. (Of course, OpenSSH is already in the system with a BSD license, so you may want ot just use the code and leave the BSD license. IANAL. When it is included, the code to get hte passsphrase will need the ability to request a PIN for the SMartCard instead of the pass phrase. (The dialog could either provide a radio button to select or have two entry lines if a SmartCard is present.) OpenSSH-portable needs to be configured with --with-opensc to work with SmartCards and is dependent on OpenSC (and, probably, OpenCT).
It'd be really awesome if openssh supported PKCS#11 then gnome-keyring could simply be one of many PKCS#11 providers, and the various drivers for these smart cards would still work.
It seems that openssh now support pkcs#11 https://bugzilla.mindrot.org/show_bug.cgi?id=1371
Yes, indeed it dos and has for a few years, but gnome-keyring seems to still lack support. I would think that this might be easily implemented at this time so that I would no longer need to turn off ssh in hte daemon and manually do an ssh-add every time.
To be specific, it would be nice if the SSH agent operations ADD_SMARTCARD_KEY, REMOVE_SMARTCARD_KEY and ADD_SMARTCARD_KEY_CONSTRAINED were implemented. The fact that gnome-keyring is a PKCS#11 provider does not help.
gnome-keyring should just wrap stock ssh-agent to solve this problem: https://bugzilla.gnome.org/show_bug.cgi?id=775981
I haven't really tested this, but it should work now given that bug 775981 landed. Feel free to reopen if it is not the case.