Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Is it possible to setup SSH (via pam for instance) to check the public key of the connecting client against a CA server? I've tried with gnupg (via gpg-agent --daemon --enable-ssh-support) and also tried working with OpenCA which prooved to be a challenge just to install. Also the documentation is horrific when it comes to both of these.

What i'd like to accomplish is something along the lines of:
[Client] --SSH--> "Server" <---> [CA Server]

The entire platform is *nix based and i'm open to suggestions right about now cause i've been stuck on this for a while now.


I've set it up in a as basic mode as possible following these guides:

My initial thought was to set up my own "key-server" which gpg can send and check for keys, but there's no information about this what so ever (or at least none that i could find).

And from what i understand i should be able to do ssh-add -l to list all my keys, but this gives me: The agent has no identities. which is not so odd because i've never specified where to fetch them but "it should just work"(...?).

The gpg.conf looks like:

... lots of default ...
personal-digest-preferences SHA512
cert-digest-algo SHA512
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
homedir /etc/gnupg

and my gpg-agent.conf:

pinentry-program /usr/bin/pinentry-curses
default-cache-ttl 10800
default-cache-ttl-ssh 10800
write-env-file /etc/gnupg/.gpg-agent-info

And just to verify that i actually have a key and gpg is responding:

~]# gpg --list-keys
pub    4096R/#######2 2013-12-10 [expired: 2014-12-10]
uid                   Anton (...) <mail>
sub    4096R/#######5 2013-12-10 [expires: 2014-12-10]


When finally everything was in place and started, I get to a website that says my "symetric keylength is to short" and I can't get past that.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.