PKCS#11 provider in OpenSSH: Is it possible to cache PIN?
3
votes
1
answer
832
views
I use a RSA key on a smartcard with an OpenSSH client. The smartcard is read by a smartcard reader with a pinpad. The key is protected with a PIN.
Is it possible to cache the PIN somehow? I don't really like the need to write the PIN using the card reader keyboard every time I use ssh... It's not only annoying but it also makes IMHO too many possibilities for other people's eyes.
My setup is Debian/Devuan + OpenSC + the typical "PKCS11Provider /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so" in .ssh/config.
I tried to add to opensc.conf, framework pkcs15 following lines, but with no effect:
use_pin_caching = true;
pin_cache_counter = 64;
pin_cache_ignore_user_consent = true;
I use the same configuration on OpenBSD, and it's the same.
As a smart card I use Aventra MyEID 4.5.5. As I am trying to learn as much as possible before using the technology in production, I have different card readers I can try: Cherry, Gemalto (now Thales) and SCM/Identiv.
Asked by d.c.
(907 rep)
Mar 20, 2023, 09:51 PM
Last activity: Feb 12, 2024, 06:49 PM
Last activity: Feb 12, 2024, 06:49 PM