SSH Connections with YubiKey PKCS#11 User Authentication(PIV)

Owned by NetSarang Support
Last updated: Aug 20, 2020
3 min read

 

PKCS#11 Driver(Middleware) and Tool Installation

In order to proceed with PKCS#11 authentication in Xshell, you’ll need a Windows Type Smart Card Minidriver. Using the PKCS11 Minidriver provided by OpenSC middleware, you can obtain a compatible RSA key authentication.

  1. Go to the following page to download the Windows Type OpenSC Library. (https://github.com/OpenSC/OpenSC/releases)

  2. Under Assets, download the 32bit OpenSC installation file (OpenSC-0.xx.x_win32.msi).

     

  3. Open the installation file to begin installation. When prompted to select a Setup Type, select Typical.

     

  4. After the installation completes, check that the file exists in the following path:
    C:\Program Files (x86)\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll

Registering the Hardware Token’s RSA Public Key on the SSH Server

  1. Confirm the hardware token’s public key:

    1. pkcs15-tool --list-public-keys

       

    2. pkcs15-tool.exe --read-ssh-key [RSA PIV AUTH pubkey ID]

       

  2. Copy the public key from above and register it in the server’s AuthorizedKeysFile. OpenSSH’s default AuthorizedKeyFile is in the ‘.ssh/authorized_keys’ file of the user’s home directory.

    Note: Only the user should have access rights to the authorized_keys file and the ssh directory.

Creating and Connecting to a PKCS#11 Session

Now you’ll need to create a session in Xshell in order to utilize PKCS#11 authentication.

  1. Run Xshell and click ‘New…’ under the File Menu.

     

  2. You should see the Connection Properties page where you need to enter the Session File Name and the Host Address.

     

  3. From the left menu, click ‘Authentication' and select PKSC11 as the authentication method. Then click the ‘Setup' button.
    Note: Even if you don’t enter a User Name at this time, you’ll have a chance to enter it during the actual authentication process.

     

  4. In the PKCS11 Setup window, enter the Middleware Path and Token Pin.
    - Middleware Path: This is the location of the OpenSC library (C:\Program Files (x86)\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll)
    - Token Pin: This is the PIN which was setup in the USB token. This PIN can also be entered during the actual authentication process. (You may need to refer to the hardware token provider's software and user manual for setting and checking token pins.)

     

  5. Setup is now finished. You can now run the session file.