Todd Denniston wrote, On 12/04/2007 04:52 PM:
From what I understood, the change to openssh listed in: rpm -q --changelog openssh |less as: "* Wed Jun 20 2007 Tomas Mraz tmraz@redhat.com - 4.5p1-7
- experimental NSS keys support
- correctly setup context when empty level requested (#234951)
" was supposed to allow the Common Access Card (CAC) to work with the shipped Fedora 8 ssh.
As per NSS usual, everything is undocumented, i.e., `ssh-add --help` does not help at all, and `man ssh-add` points to `ssh-add -s reader` # ssh-add -s 0 Enter passphrase for smartcard: SSH_AGENT_FAILURE Could not add card: 0 # ssh-add -s 1 Enter passphrase for smartcard: SSH_AGENT_FAILURE Could not add card: 1
So does anyone know how to use the possible functionality, or are we reduced to reading the source?
After a bit of RTFS, I found README.nss which is installed to /usr/share/doc/openssh-4.7p1/ in FC8.
Trying to use the info in that document gets me: # ssh -o 'UseNSS yes' otherhost Failed to initialize NSS library Permission denied (publickey,keyboard-interactive). # ssh-add -n Failed to initialize NSS library # ssh-keygen -n Failed to initialize NSS library cannot find public key in NSS
no idea what 'NSS Token My PKCS11 Token' 'My PKCS11 Token' or 'My Key ID' are supposed to be set to (how do I match that up with "use the cac card" or "my common name is"?).
drop back and punt[1] has been called. [1] https://bugzilla.redhat.com/show_bug.cgi?id=186469#c8