Package: openssh-client Version: 1:5.1p1-2 Severity: wishlist Tags: patch Hi, might you please enable opensc-support in openssh? My first patch enable this via debian/rules and add build depends to libopensc2-dev. The second patch allow to type the token pin if using 'ssh -I'. ssh-add in combination with ssh-agent works without the second patch. Greetings, Christoph -- System Information: Debian Release: lenny/sid APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.27-rc7-00094-gc0f4d6d (SMP w/2 CPU cores; PREEMPT) Locale: LANG=de_DE@euro, LC_CTYPE=de_DE@euro (charmap=ISO-8859-15) Shell: /bin/sh linked to /bin/bash Versions of packages openssh-client depends on: ii adduser 3.110 add and remove users and groups ii debconf [debconf-2.0] 1.5.22 Debian configuration management sy ii dpkg 1.14.22 Debian package management system ii libc6 2.7-13 GNU C Library: Shared libraries ii libcomerr2 1.41.0-3 common error description library ii libedit2 2.11~20080614-1 BSD editline and history libraries ii libkrb53 1.6.dfsg.4~beta1-4 MIT Kerberos runtime libraries ii libncurses5 5.6+20080830-1 shared libraries for terminal hand ii libopensc2 0.11.4-5 SmartCard library with support for ii libssl0.9.8 0.9.8g-13 SSL shared libraries ii passwd 1:4.1.1-5 change and administer password and ii zlib1g 1:1.2.3.3.dfsg-12 compression library - runtime Versions of packages openssh-client recommends: ii openssh-blacklist 0.4.1 list of default blacklisted OpenSS pn openssh-blacklist-extra <none> (no description available) ii xauth 1:1.0.3-2 X authentication utility Versions of packages openssh-client suggests: pn keychain <none> (no description available) pn libpam-ssh <none> (no description available) ii ssh-askpass-gnome [ssh-askpas 1:5.1p1-2 interactive X program to prompt us -- no debconf information
From 6c743d8da70d04d7c044c781e16c2bf0c353c273 Mon Sep 17 00:00:00 2001 From: Christoph Goehre <christoph.goehre@gmx.de> Date: Sat, 27 Sep 2008 19:07:34 +0200 Subject: [PATCH] build with-opensc --- debian/control | 2 +- debian/rules | 1 + 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/debian/control b/debian/control index 27b27e7..c037d1b 100644 --- a/debian/control +++ b/debian/control @@ -2,7 +2,7 @@ Source: openssh Section: net Priority: standard Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> -Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev (>= 1:1.2.3-1), libssl-dev (>= 0.9.8-1), libpam0g-dev | libpam-dev, libgtk2.0-dev, libedit-dev, debhelper (>= 5.0.22), sharutils, libselinux1-dev [alpha amd64 arm armeb armel hppa i386 ia64 lpia m68k mips mipsel powerpc ppc64 s390 sparc], libkrb5-dev | heimdal-dev +Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev (>= 1:1.2.3-1), libssl-dev (>= 0.9.8-1), libpam0g-dev | libpam-dev, libgtk2.0-dev, libedit-dev, debhelper (>= 5.0.22), sharutils, libselinux1-dev [alpha amd64 arm armeb armel hppa i386 ia64 lpia m68k mips mipsel powerpc ppc64 s390 sparc], libkrb5-dev | heimdal-dev, libopensc2-dev Standards-Version: 3.7.3 Uploaders: Colin Watson <cjwatson@debian.org>, Matthew Vernon <matthew@debian.org> diff --git a/debian/rules b/debian/rules index fb3f3a1..b0b06ba 100755 --- a/debian/rules +++ b/debian/rules @@ -84,6 +84,7 @@ confflags += --with-ssl-engine ifeq ($(DEB_HOST_ARCH_OS),linux) confflags += --with-selinux endif +confflags += --with-opensc # The deb build wants xauth; the udeb build doesn't. confflags += --with-xauth=/usr/bin/X11/xauth -- 1.5.6.5
From b576575b2a4887378bede9b0064f9c1126c06c36 Mon Sep 17 00:00:00 2001
From: Christoph Goehre <christoph.goehre@gmx.de>
Date: Sat, 27 Sep 2008 19:30:21 +0200
Subject: [PATCH] apply smartcard-ask-for-passphrase-patch
from OpenSSH Bugzilla (Bug 608)
https://bugzilla.mindrot.org/show_bug.cgi?id=608
---
scard-opensc.c | 44 +++++++++++++++++++++++++++++++++++---------
scard.c | 3 +++
scard.h | 2 ++
ssh.c | 3 +++
4 files changed, 43 insertions(+), 9 deletions(-)
diff --git a/scard-opensc.c b/scard-opensc.c
index 36dae05..042544a 100644
--- a/scard-opensc.c
+++ b/scard-opensc.c
@@ -43,6 +43,8 @@
#include "misc.h"
#include "scard.h"
+int ask_for_pin=0;
+
#if OPENSSL_VERSION_NUMBER < 0x00907000L && defined(CRYPTO_LOCK_ENGINE)
#define USE_ENGINE
#define RSA_get_default_method RSA_get_default_openssl_method
@@ -124,6 +126,7 @@ sc_prkey_op_init(RSA *rsa, struct sc_pkcs15_object **key_obj_out,
struct sc_pkcs15_prkey_info *key;
struct sc_pkcs15_object *pin_obj;
struct sc_pkcs15_pin_info *pin;
+ char *passphrase = NULL;
priv = (struct sc_priv_data *) RSA_get_app_data(rsa);
if (priv == NULL)
@@ -161,24 +164,47 @@ sc_prkey_op_init(RSA *rsa, struct sc_pkcs15_object **key_obj_out,
goto err;
}
pin = pin_obj->data;
+
+ if (sc_pin)
+ passphrase = sc_pin;
+ else if (ask_for_pin) {
+ /* we need a pin but don't have one => ask for the pin */
+ char prompt[64];
+
+ snprintf(prompt, sizeof(prompt), "Enter PIN for %s: ",
+ key_obj->label ? key_obj->label : "smartcard key");
+ passphrase = read_passphrase(prompt, 0);
+ if (!passphrase || !strcmp(passphrase, ""))
+ goto err;
+ } else
+ /* no pin => error */
+ goto err;
+
r = sc_lock(card);
if (r) {
error("Unable to lock smartcard: %s", sc_strerror(r));
goto err;
}
- if (sc_pin != NULL) {
- r = sc_pkcs15_verify_pin(p15card, pin, sc_pin,
- strlen(sc_pin));
- if (r) {
- sc_unlock(card);
- error("PIN code verification failed: %s",
- sc_strerror(r));
- goto err;
- }
+ r = sc_pkcs15_verify_pin(p15card, pin, passphrase,
+ strlen(passphrase));
+ if (r) {
+ sc_unlock(card);
+ error("PIN code verification failed: %s",
+ sc_strerror(r));
+ goto err;
}
+
*key_obj_out = key_obj;
+ if (!sc_pin) {
+ memset(passphrase, 0, strlen(passphrase));
+ xfree(passphrase);
+ }
return 0;
err:
+ if (!sc_pin && passphrase) {
+ memset(passphrase, 0, strlen(passphrase));
+ xfree(passphrase);
+ }
sc_close();
return -1;
}
diff --git a/scard.c b/scard.c
index 9fd3ca1..e2d2812 100644
--- a/scard.c
+++ b/scard.c
@@ -40,6 +40,9 @@
#include "misc.h"
#include "scard.h"
+/* currently unused */
+int ask_for_pin = 0;
+
#if OPENSSL_VERSION_NUMBER < 0x00907000L
#define USE_ENGINE
#define RSA_get_default_method RSA_get_default_openssl_method
diff --git a/scard.h b/scard.h
index 82efe48..fe8d659 100644
--- a/scard.h
+++ b/scard.h
@@ -31,6 +31,8 @@
#define SCARD_ERROR_NOCARD -2
#define SCARD_ERROR_APPLET -3
+extern int ask_for_pin;
+
Key **sc_get_keys(const char *, const char *);
void sc_close(void);
int sc_put_key(Key *, const char *);
diff --git a/ssh.c b/ssh.c
index e2e2ef4..23e8451 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1243,6 +1243,9 @@ load_public_identity_files(void)
#ifdef SMARTCARD
Key **keys;
+ if (!options.batch_mode)
+ ask_for_pin = 1;
+
if (options.smartcard_device != NULL &&
options.num_identity_files < SSH_MAX_IDENTITY_FILES &&
(keys = sc_get_keys(options.smartcard_device, NULL)) != NULL) {
--
1.5.6.5
Attachment:
signature.asc
Description: Digital signature