Is it possible to set up SSH (via pam for instance) to check the public key of the connecting client against a CA server?
I've tried with gnupg (via gpg-agent --daemon --enable-ssh-support
) and also tried working with OpenCA which proved to be a challenge just to install.
Also, the documentation is horrific when it comes to both of these.
What I'd like to accomplish is something along the lines of:
[Client] --SSH--> "Server" <---> [CA Server]
The entire platform is *nix based and I'm open to suggestions right about now cause I've been stuck on this for a while now.
GnuPG
I've set it up in as simply as possible following these guides:
- http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ssh-agent-setup/
- https://wiki.archlinux.org/index.php/GnuPG
My initial thought was to set up my own "key-server" which gpg
can send and check for keys, but there's no information about this what so ever (or at least none that I could find).
And from what I understand I should be able to do ssh-add -l
to list all my keys, but this gives me: The agent has no identities.
which is not so odd because I've never specified where to fetch them but "it should just work"(...?).
The gpg.conf looks like:
... lots of default ...
personal-digest-preferences SHA512
cert-digest-algo SHA512
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
homedir /etc/gnupg
use-agent
and my gpg-agent.conf:
pinentry-program /usr/bin/pinentry-curses
default-cache-ttl 10800
default-cache-ttl-ssh 10800
write-env-file /etc/gnupg/.gpg-agent-info
enable-ssh-support
And just to verify that i actually have a key and gpg is responding:
~]# gpg --list-keys
/etc/gnupg/pubring.gpg
----------------------
pub 4096R/#######2 2013-12-10 [expired: 2014-12-10]
uid Anton (...) <mail>
sub 4096R/#######5 2013-12-10 [expires: 2014-12-10]
OpenCA
When finally everything was in place and started, I get to a website that says my "symmetric keylength is too short" and I can't get past that.