putty-cac

PuTTY-CAC was an interesting, although imperfect solution to using PIV/CAC cards together with SSH. I remember piloting it from 2013-2014 at an agency. Back then, it was maintained by Dan Risacher[0]. Nowadays it is maintained on GitHub[1] and adopted some interesting features like FIDO. [0] https://risacher.org/putty-cac/ [1] https://github.com/NoMoreFood/putty-cac

>so I've been working on extending our support for hardware-backed SSH certificates to Windows Interesting work & I wish him luck. The ability to use hardware SSH certs on Windows has been around for at least a decade now, but it hasn't been a seamless experience. The other attempt I'm aware of is PuTTY-CAC[0]. It is recommended[1] for security-conscious organizations, and approved for use at places like the US Department of Veteran Affairs[2]. Vendors[3] of smart cards also show some limited support for it. The issue with PuTTY-CAC is that the server still needs to be configured to check the certificate against CRLs & PKI infrastructure. Over the past decade, I believe Red Hat has made some significant progress towards a workable solution[4], however, I have no experience with it. [0] https://github.com/NoMoreFood/putty-cac [1] https://p

I'm been using a pretty "obscure" fork named PuTTY CAC. The big feature added is that you can use it with a SmartCard including a Yubikey. I know the most popular use of Yubikey + SSH is via OpenPGP but it involves a lot of things which are not working very well on Windows (namely GPG4Win, unstable gpg-connect-agent, etc.). With this fork, you just need to install the official Yubikey mini driver to have it work with PuTTY CAC. (You will also need Yubikey Manager to configure your key). Connect your Yubikey, launch PuTTY CAC, look in SSH>Certificate, enable Attempt cert auth, Set CAPI cert (choose your Yubikey cert). It even works through Windows Remote Desktop. https://github.com/NoMoreFood/putty-cac

Yeah, it's cool! A couple extra tips: - You can put "PKCS11Provider /usr/lib...." in your .ssh/config file (even tied to a specific Host block) to make it load the module automatically instead of having to use an argument every time you run ssh/sftp/scp/etc. - For windows, putty-cac works well with the built-in smartcard/crypto API (CAPI), even on machines where you don't have administrative access (like my work machine). It even has its own version of pageant, so it'll work with tools like WinSCP as well. https://risacher.org/putty-cac/ https://github.com/NoMoreFood/putty-cac/releases