Here's a brief guide for setting up SSH with YubiKey as a smartcard which comple...

tra3 · on Feb 7, 2016

Thanks for the link! I wish this was a little bit easier though. One of my coworkers still prefers a password list in notepad vs key-based authentication. This looks quite complicated.

hobarrera · on Feb 8, 2016

Looks like I'd need to configure gpg to use it locally first.

One of the main uses of smartcards is to use it on other machines (eg: not mine). What's the added benefit of adding one if I'm logging in from my local machine?

rkeene2 · on Feb 8, 2016

For what it's worth, most smartcard applets don't typically store GPG objects but RSA keys (and also usually X.509 certificate objects that go along with them, as well as less-used RSA public key objects).

I use PIV (NIST SP 800-73) compliant smartcards with a PKCS#11 module I wrote (CACKey), it just works with "ssh-add -s /path/to/libcackey.so", then SSH away.

Additionally, there is a fork of OpenSSH called PKIXSSH that adds X.509 certificate support (in addition to the relatively recent, compared to the fork, support for OpenSSH certificates) and then I can authenticate to remote systems using my certificate -- which is helpful when my card is replaced, or if my certificate is revoked the CRLs can be used.