head 1.4; access; symbols perseant-exfatfs-base-20261102:1.4 perseant-exfatfs-base-20250801:1.4 perseant-exfatfs-base-20240630:1.4 perseant-exfatfs:1.4.0.24 perseant-exfatfs-base:1.4 cjep_sun2x:1.4.0.22 cjep_sun2x-base:1.4 cjep_staticlib_x-base1:1.4 cjep_staticlib_x:1.4.0.20 cjep_staticlib_x-base:1.4 phil-wifi-20200421:1.4 phil-wifi-20200411:1.4 phil-wifi-20200406:1.4 pgoyette-compat-merge-20190127:1.4 pgoyette-compat-20190127:1.4 pgoyette-compat-20190118:1.4 pgoyette-compat-1226:1.4 pgoyette-compat-1126:1.4 pgoyette-compat-1020:1.4 pgoyette-compat-0930:1.4 pgoyette-compat-0906:1.4 pgoyette-compat-0728:1.4 pgoyette-compat-0625:1.4 pgoyette-compat-0521:1.4 pgoyette-compat-0502:1.4 pgoyette-compat-0422:1.4 pgoyette-compat-0415:1.4 pgoyette-compat-0407:1.4 pgoyette-compat-0330:1.4 pgoyette-compat-0322:1.4 pgoyette-compat-0315:1.4 pgoyette-compat:1.4.0.18 pgoyette-compat-base:1.4 perseant-stdc-iso10646:1.4.0.16 perseant-stdc-iso10646-base:1.4 prg-localcount2-base3:1.4 prg-localcount2-base2:1.4 prg-localcount2-base1:1.4 prg-localcount2:1.4.0.14 prg-localcount2-base:1.4 pgoyette-localcount-20170426:1.4 bouyer-socketcan-base1:1.4 pgoyette-localcount-20170320:1.4 bouyer-socketcan:1.4.0.12 bouyer-socketcan-base:1.4 pgoyette-localcount-20170107:1.4 pgoyette-localcount-20161104:1.4 localcount-20160914:1.4 pgoyette-localcount-20160806:1.4 pgoyette-localcount-20160726:1.4 pgoyette-localcount:1.4.0.10 pgoyette-localcount-base:1.4 netbsd-5-2-3-RELEASE:1.3 netbsd-5-1-5-RELEASE:1.3 yamt-pagecache-base9:1.4 yamt-pagecache-tag8:1.4 tls-earlyentropy:1.4.0.6 tls-earlyentropy-base:1.4 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.4 riastradh-drm2-base3:1.4 netbsd-5-2-2-RELEASE:1.3 netbsd-5-1-4-RELEASE:1.3 netbsd-5-2-1-RELEASE:1.3 netbsd-5-1-3-RELEASE:1.3 agc-symver:1.4.0.8 agc-symver-base:1.4 tls-maxphys-base:1.4 yamt-pagecache-base8:1.4 netbsd-5-2:1.3.0.44 yamt-pagecache-base7:1.4 netbsd-5-2-RELEASE:1.3 netbsd-5-2-RC1:1.3 yamt-pagecache-base6:1.4 yamt-pagecache-base5:1.4 yamt-pagecache-base4:1.4 netbsd-5-1-2-RELEASE:1.3 netbsd-5-1-1-RELEASE:1.3 yamt-pagecache-base3:1.4 yamt-pagecache-base2:1.4 yamt-pagecache:1.4.0.4 yamt-pagecache-base:1.4 bouyer-quota2-nbase:1.4 bouyer-quota2:1.4.0.2 bouyer-quota2-base:1.4 matt-nb5-mips64-premerge-20101231:1.3 matt-nb5-pq3:1.3.0.42 matt-nb5-pq3-base:1.3 netbsd-5-1:1.3.0.40 netbsd-5-1-RELEASE:1.3 netbsd-5-1-RC4:1.3 matt-nb5-mips64-k15:1.3 netbsd-5-1-RC3:1.3 netbsd-5-1-RC2:1.3 netbsd-5-1-RC1:1.3 netbsd-5-0-2-RELEASE:1.3 matt-nb5-mips64-premerge-20091211:1.3 matt-nb5-mips64-u2-k2-k4-k7-k8-k9:1.3 matt-nb4-mips64-k7-u2a-k9b:1.3 matt-nb5-mips64-u1-k1-k5:1.3 matt-nb5-mips64:1.3.0.38 netbsd-5-0-1-RELEASE:1.3 jym-xensuspend-nbase:1.3 netbsd-5-0:1.3.0.36 netbsd-5-0-RELEASE:1.3 netbsd-5-0-RC4:1.3 netbsd-5-0-RC3:1.3 v51-20090216:1.1.1.3 netbsd-5-0-RC2:1.3 jym-xensuspend:1.3.0.34 jym-xensuspend-base:1.3 netbsd-5-0-RC1:1.3 netbsd-5:1.3.0.32 netbsd-5-base:1.3 matt-mips64-base2:1.3 matt-mips64:1.3.0.30 mjf-devfs2:1.3.0.28 mjf-devfs2-base:1.3 netbsd-4-0-1-RELEASE:1.3 wrstuden-revivesa-base-3:1.3 wrstuden-revivesa-base-2:1.3 wrstuden-fixsa-newbase:1.3 wrstuden-revivesa-base-1:1.3 yamt-pf42-base4:1.3 yamt-pf42-base3:1.3 hpcarm-cleanup-nbase:1.3 yamt-pf42-baseX:1.3 yamt-pf42-base2:1.3 wrstuden-revivesa:1.3.0.26 wrstuden-revivesa-base:1.3 yamt-pf42:1.3.0.24 yamt-pf42-base:1.3 v50-20080403:1.1.1.3 keiichi-mipv6:1.3.0.22 keiichi-mipv6-base:1.3 matt-armv6-nbase:1.3 matt-armv6-prevmlocking:1.3 wrstuden-fixsa-base-1:1.3 v47-20070904:1.1.1.3 netbsd-4-0:1.3.0.20 netbsd-4-0-RELEASE:1.3 cube-autoconf:1.3.0.18 cube-autoconf-base:1.3 netbsd-4-0-RC5:1.3 netbsd-4-0-RC4:1.3 netbsd-4-0-RC3:1.3 netbsd-4-0-RC2:1.3 netbsd-4-0-RC1:1.3 matt-armv6:1.3.0.16 matt-armv6-base:1.3 matt-mips64-base:1.3 hpcarm-cleanup:1.3.0.14 hpcarm-cleanup-base:1.3 netbsd-3-1-1-RELEASE:1.3 netbsd-3-0-3-RELEASE:1.3 wrstuden-fixsa:1.3.0.12 wrstuden-fixsa-base:1.3 vr46-20070310:1.1.1.3 abandoned-netbsd-4-base:1.3 abandoned-netbsd-4:1.3.0.6 netbsd-3-1:1.3.0.8 netbsd-3-1-RELEASE:1.3 netbsd-3-0-2-RELEASE:1.3 netbsd-3-1-RC4:1.3 v44-20060927:1.1.1.3 netbsd-3-1-RC3:1.3 netbsd-3-1-RC2:1.3 netbsd-3-1-RC1:1.3 netbsd-4:1.3.0.10 netbsd-4-base:1.3 netbsd-3-0-1-RELEASE:1.3 v43-20060201:1.1.1.3 netbsd-3-0:1.3.0.4 netbsd-3-0-RELEASE:1.3 netbsd-3-0-RC6:1.3 netbsd-3-0-RC5:1.3 netbsd-3-0-RC4:1.3 netbsd-3-0-RC3:1.3 netbsd-3-0-RC2:1.3 netbsd-3-0-RC1:1.3 netbsd-2-0-3-RELEASE:1.2 netbsd-2-1:1.2.0.8 netbsd-2-1-RELEASE:1.2 netbsd-2-1-RC6:1.2 netbsd-2-1-RC5:1.2 netbsd-2-1-RC4:1.2 netbsd-2-1-RC3:1.2 netbsd-2-1-RC2:1.2 netbsd-2-1-RC1:1.2 v40-20050308:1.1.1.3 netbsd-2-0-2-RELEASE:1.2 netbsd-3:1.3.0.2 netbsd-3-base:1.3 v39-20040816:1.1.1.3 netbsd-2-0-1-RELEASE:1.2 netbsd-2:1.2.0.6 netbsd-2-base:1.2 netbsd-2-0-RELEASE:1.2 netbsd-2-0-RC5:1.2 netbsd-2-0-RC4:1.2 netbsd-2-0-RC3:1.2 netbsd-2-0-RC2:1.2 netbsd-2-0-RC1:1.2 netbsd-2-0:1.2.0.4 netbsd-2-0-base:1.2 netbsd-1-6-PATCH002-RELEASE:1.2 netbsd-1-6-PATCH002:1.2 netbsd-1-6-PATCH002-RC4:1.2 netbsd-1-6-PATCH002-RC3:1.2 netbsd-1-6-PATCH002-RC2:1.2 netbsd-1-6-PATCH002-RC1:1.2 netbsd-1-6-PATCH001:1.2 v361-20030403:1.1.1.2 netbsd-1-6-PATCH001-RELEASE:1.2 netbsd-1-6-PATCH001-RC3:1.2 netbsd-1-6-PATCH001-RC2:1.2 netbsd-1-6-PATCH001-RC1:1.2 fvdl_fs64_base:1.2 v35-20021001:1.1.1.2 netbsd-1-6-RELEASE:1.2 netbsd-1-6-RC3:1.2 netbsd-1-6-RC2:1.2 netbsd-1-6-RC1:1.2 v34-20020626:1.1.1.2 v33-20020624:1.1.1.2 netbsd-1-6:1.2.0.2 netbsd-1-6-base:1.2 v321-20020513:1.1.1.2 v32-20020422:1.1.1.2 netbsd-1-5-PATCH003:1.1.1.1.2.2 v31-20020308:1.1.1.1 netbsd-1-5:1.1.1.1.0.2 v302-20011206:1.1.1.1 v301-20011127:1.1.1.1 v30-20011107:1.1.1.1 v299-20010927:1.1.1.1 OPENSSH:1.1.1; locks; strict; comment @# @; 1.4 date 2009.07.20.17.39.01; author christos; state dead; branches; next 1.3; 1.3 date 2005.02.13.05.57.25; author christos; state Exp; branches; next 1.2; 1.2 date 2002.04.22.07.59.35; author itojun; state Exp; branches; next 1.1; 1.1 date 2001.09.27.02.00.33; author itojun; state Exp; branches 1.1.1.1; next ; 1.1.1.1 date 2001.09.27.02.00.33; author itojun; state Exp; branches 1.1.1.1.2.1; next 1.1.1.2; 1.1.1.2 date 2002.04.22.07.38.01; author itojun; state Exp; branches; next 1.1.1.3; 1.1.1.3 date 2005.02.13.00.52.43; author christos; state Exp; branches; next ; 1.1.1.1.2.1 date 2001.09.27.02.00.33; author he; state dead; branches; next 1.1.1.1.2.2; 1.1.1.1.2.2 date 2001.12.10.23.54.56; author he; state Exp; branches; next ; desc @@ 1.4 log @ssh has moved (a long time ago) @ text @How to use smartcards with OpenSSH? OpenSSH contains experimental support for authentication using Cyberflex smartcards and TODOS card readers. To enable this you need to: (1) enable SMARTCARD support in OpenSSH: $ vi /usr/src/usr.bin/ssh/Makefile.inc and uncomment CFLAGS+= -DSMARTCARD LDADD+= -lsectok (2) If you have used a previous version of ssh with your card, you must remove the old applet and keys. $ sectok sectok> login -d sectok> junload Ssh.bin sectok> delete 0012 sectok> delete sh sectok> quit (3) load the Java Cardlet to the Cyberflex card and set card passphrase: $ sectok sectok> login -d sectok> jload /usr/libdata/ssh/Ssh.bin sectok> setpass Enter new AUT0 passphrase: Re-enter passphrase: sectok> quit Do not forget the passphrase. There is no way to recover if you do. IMPORTANT WARNING: If you attempt to login with the wrong passphrase three times in a row, you will destroy your card. (4) load a RSA key to the card: $ ssh-keygen -f /path/to/rsakey -U 1 (where 1 is the reader number, you can also try 0) In spite of the name, this does not generate a key. It just loads an already existing key on to the card. (5) tell the ssh client to use the card reader: $ ssh -I 1 otherhost (6) or tell the agent (don't forget to restart) to use the smartcard: $ ssh-add -s 1 (7) Optional: If you don't want to use a card passphrase, change the acl on the private key file: $ sectok sectok> login -d sectok> acl 0012 world: w world: w AUT0: w inval sectok> quit If you do this, anyone who has access to your card can assume your identity. This is not recommended. -markus, Tue Jul 17 23:54:51 CEST 2001 $OpenBSD: README.smartcard,v 1.9 2003/11/21 11:57:02 djm Exp $ @ 1.3 log @Resolve conflicts. @ text @@ 1.2 log @sync with openssh 3.2 as of 2002/4/22. - privilege separation - afs/kerberos auth security issue fixed @ text @d30 2 a31 2 Enter new AUT0 passphrase: Re-enter passphrase: d62 3 a64 3 sectok> acl 0012 world: w world: w AUT0: w inval d73 1 a73 1 $OpenBSD: README.smartcard,v 1.8 2002/03/26 18:56:23 rees Exp $ @ 1.1 log @Initial revision @ text @d7 1 a7 8 (1) install sectok $ cd /usr/src/lib/libsectok $ make obj depend all install includes $ cd /usr/src/usr.bin/sectok $ make obj depend all install (2) enable SMARTCARD support in OpenSSH: d14 2 a15 1 (3) load the Java Cardlet to the Cyberflex card: d19 3 a21 1 sectok> jload /usr/libdata/ssh/Ssh.bin d24 1 a24 16 (4) load a RSA key to the card: please don't use your production RSA keys, since with the current version of sectok/ssh-keygen the private key file is still readable $ ssh-keygen -f /path/to/rsakey -U 1 (where 1 is the reader number, you can also try 0) In spite of the name, this does not generate a key. It just loads an already existing key on to the card. (5) optional: Change the card password so that only you can read the private key: d28 1 d30 2 a33 3 This prevents reading the key but not use of the key by the card applet. d41 9 a49 1 (6) tell the ssh client to use the card reader: d53 1 a53 1 (7) or tell the agent (don't forget to restart) to use the smartcard: d57 13 d72 2 @ 1.1.1.1 log @OpenSSH 2.9.9 as of 2001/9/27 @ text @@ 1.1.1.1.2.1 log @file README.smartcard was added on branch netbsd-1-5 on 2001-12-10 23:54:56 +0000 @ text @d1 69 @ 1.1.1.1.2.2 log @Pull up revision 1.1 (requested by itojun): Upgrade OpenSSH to version 3.0.2. @ text @a0 69 How to use smartcards with OpenSSH? OpenSSH contains experimental support for authentication using Cyberflex smartcards and TODOS card readers. To enable this you need to: (1) install sectok $ cd /usr/src/lib/libsectok $ make obj depend all install includes $ cd /usr/src/usr.bin/sectok $ make obj depend all install (2) enable SMARTCARD support in OpenSSH: $ vi /usr/src/usr.bin/ssh/Makefile.inc and uncomment CFLAGS+= -DSMARTCARD LDADD+= -lsectok (3) load the Java Cardlet to the Cyberflex card: $ sectok sectok> login -d sectok> jload /usr/libdata/ssh/Ssh.bin sectok> quit (4) load a RSA key to the card: please don't use your production RSA keys, since with the current version of sectok/ssh-keygen the private key file is still readable $ ssh-keygen -f /path/to/rsakey -U 1 (where 1 is the reader number, you can also try 0) In spite of the name, this does not generate a key. It just loads an already existing key on to the card. (5) optional: Change the card password so that only you can read the private key: $ sectok sectok> login -d sectok> setpass sectok> quit This prevents reading the key but not use of the key by the card applet. Do not forget the passphrase. There is no way to recover if you do. IMPORTANT WARNING: If you attempt to login with the wrong passphrase three times in a row, you will destroy your card. (6) tell the ssh client to use the card reader: $ ssh -I 1 otherhost (7) or tell the agent (don't forget to restart) to use the smartcard: $ ssh-add -s 1 -markus, Tue Jul 17 23:54:51 CEST 2001 @ 1.1.1.2 log @OpenSSH 3.2 as of 2002/4/22. fixes issues with AFS/kerberos auth @ text @d7 8 a14 1 (1) enable SMARTCARD support in OpenSSH: d21 1 a21 2 (2) If you have used a previous version of ssh with your card, you must remove the old applet and keys. d25 1 a25 3 sectok> junload Ssh.bin sectok> delete 0012 sectok> delete sh d28 16 a43 1 (3) load the Java Cardlet to the Cyberflex card and set card passphrase: a46 1 sectok> jload /usr/libdata/ssh/Ssh.bin a47 2 Enter new AUT0 passphrase: Re-enter passphrase: d50 3 d60 1 a60 9 (4) load a RSA key to the card: $ ssh-keygen -f /path/to/rsakey -U 1 (where 1 is the reader number, you can also try 0) In spite of the name, this does not generate a key. It just loads an already existing key on to the card. (5) tell the ssh client to use the card reader: d64 1 a64 1 (6) or tell the agent (don't forget to restart) to use the smartcard: a67 13 (7) Optional: If you don't want to use a card passphrase, change the acl on the private key file: $ sectok sectok> login -d sectok> acl 0012 world: w world: w AUT0: w inval sectok> quit If you do this, anyone who has access to your card can assume your identity. This is not recommended. a69 2 $OpenBSD: README.smartcard,v 1.8 2002/03/26 18:56:23 rees Exp $ @ 1.1.1.3 log @from ftp.openbsd.org @ text @d30 2 a31 2 Enter new AUT0 passphrase: Re-enter passphrase: d62 3 a64 3 sectok> acl 0012 world: w world: w AUT0: w inval d73 1 a73 1 $OpenBSD: README.smartcard,v 1.9 2003/11/21 11:57:02 djm Exp $ @