Is it possible to setup SSH (via pam for instance) to check the public key of the connecting client against a CA server?
I've tried with gnupg (via
gpg-agent --daemon --enable-ssh-support) and also tried working with OpenCA which prooved to be a challenge just to install.
Also the documentation is horrific when it comes to both of these.
What i'd like to accomplish is something along the lines of:
[Client] --SSH--> "Server" <---> [CA Server]
The entire platform is *nix based and i'm open to suggestions right about now cause i've been stuck on this for a while now.
I've set it up in a as basic mode as possible following these guides:
My initial thought was to set up my own "key-server" which
gpg can send and check for keys, but there's no information about this what so ever (or at least none that i could find).
And from what i understand i should be able to do
ssh-add -l to list all my keys, but this gives me:
The agent has no identities. which is not so odd because i've never specified where to fetch them but "it should just work"(...?).
The gpg.conf looks like:
... lots of default ... personal-digest-preferences SHA512 cert-digest-algo SHA512 default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed homedir /etc/gnupg use-agent
and my gpg-agent.conf:
pinentry-program /usr/bin/pinentry-curses default-cache-ttl 10800 default-cache-ttl-ssh 10800 write-env-file /etc/gnupg/.gpg-agent-info enable-ssh-support
And just to verify that i actually have a key and gpg is responding:
~]# gpg --list-keys /etc/gnupg/pubring.gpg ---------------------- pub 4096R/#######2 2013-12-10 [expired: 2014-12-10] uid Anton (...) <mail> sub 4096R/#######5 2013-12-10 [expires: 2014-12-10]
When finally everything was in place and started, I get to a website that says my "symetric keylength is to short" and I can't get past that.