{"id":112,"date":"2018-06-06T01:45:58","date_gmt":"2018-06-05T15:45:58","guid":{"rendered":"https:\/\/hegars83.wordpress.com\/?p=112"},"modified":"2018-06-14T16:53:38","modified_gmt":"2018-06-14T16:53:38","slug":"yubikey-piv-manager","status":"publish","type":"post","link":"https:\/\/blog.hegars.com\/?p=112","title":{"rendered":"YubiKey PIV Manager"},"content":{"rendered":"

Importing a SSH key to the PIV smartcard.<\/strong><\/h2>\n

https:\/\/developers.yubico.com\/PIV\/Guides\/SSH_with_PIV_and_PKCS11.html<\/p>\n

PS C:\\Program Files (x86)\\Yubico\\YubiKey PIV Manager><\/em><\/p>\n

.\\yubico-piv-tool.exe -a import-key -s 9a -i hegars.key.pem -k<\/em>
\n Enter management key:<\/em>
\n Successfully imported a new private key.<\/em><\/p>\n

Get the PEM formatted PUB key<\/em>
\n openssl rsa -in hegars.key.pem -pubout -out hegars.pub.pem<\/em><\/p>\n

.\\yubico-piv-tool.exe -a verify-pin -a selfsign-certificate -s 9a -S “\/CN=hegars\/OU=hegars\/O=hegars.com\/” -i hegars.pub.pem -o cert.pem<\/em>
\n Enter PIN:<\/em>
\n Successfully verified PIN.<\/em>
\n Successfully generated a new self signed certificate.<\/em><\/p>\n

.\\yubico-piv-tool.exe -a import-certificate -s 9a -i cert.pem -k<\/em>
\n Enter management key:<\/em>
\n Successfully imported a new certificate.<\/em><\/p>\n

 <\/p>\n

Logging in with ssh\u00a0<\/strong><\/h2>\n

hegars@debian:~$<\/strong> ssh -I \/usr\/lib\/x86_64-linux-gnu\/opensc-pkcs11.so server.hegars.com<\/em>
\nEnter PIN for ‘PIV_II (PIV Card Holder pin)’: <\/em>
\nLinux server 4.15.13-x86_64#1 SMP Tue Mar 27 14:42:14 UTC 2018 x86_64<\/em><\/p>\n

The programs included with the Debian GNU\/Linux system are free software;<\/em>
\nthe exact distribution terms for each program are described in the<\/em>
\nindividual files in \/usr\/share\/doc\/*\/copyright.<\/em><\/p>\n

Debian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent<\/em>
\npermitted by applicable law.<\/em>
\nNo mail.<\/em>
\nLast login: Mon Jun 11 13:08:51 2018 from 1.2.3.4<\/em>
\nhegars@server:~$<\/em><\/strong><\/p>\n

Set in ~\/.ssh\/config environment variable<\/p>\n

PKCS11Provider \/usr\/lib\/x86_64-linux-gnu\/opensc-pkcs11.so<\/em><\/p>\n

hegars@debian:~$<\/strong> ssh server.hegars.com <\/em>
\nEnter PIN for ‘PIV_II (PIV Card Holder pin)’: <\/em>
\nLinux server 4.15.13-x86_64#1 SMP Tue Mar 27 14:42:14 UTC 2018 x86_64<\/em><\/p>\n

The programs included with the Debian GNU\/Linux system are free software;<\/em>
\nthe exact distribution terms for each program are described in the<\/em>
\nindividual files in \/usr\/share\/doc\/*\/copyright.<\/em><\/p>\n

Debian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent<\/em>
\npermitted by applicable law.<\/em>
\nNo mail.<\/em>
\nLast login: Mon Jun 11 13:09:17 2018 from 1.2.3.4<\/em>
\nhegars@server:~$<\/em><\/strong><\/p>\n

Read and convert the certificate from the sim card<\/h2>\n

hegars@debian:~$<\/strong> pkcs15-tool –read-certificate 01 | openssl x509 –noout -text<\/em>
\nUsing reader with a card: Yubico Yubikey NEO OTP+U2F+CCID 00 00<\/em>
\nCertificate:<\/em>
\n Data:<\/em>
\n Version: 3 (0x2)<\/em>
\n Serial Number:<\/em>
\n….<\/em>
\n….<\/em>
\nhegars@debian:~$<\/em><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Importing a SSH key to the PIV smartcard. https:\/\/developers.yubico.com\/PIV\/Guides\/SSH_with_PIV_and_PKCS11.html PS C:\\Program Files (x86)\\Yubico\\YubiKey PIV Manager> .\\yubico-piv-tool.exe -a import-key -s 9a -i hegars.key.pem -k Enter management key: Successfully imported a new private key. Get the PEM formatted PUB key openssl rsa -in hegars.key.pem -pubout -out hegars.pub.pem .\\yubico-piv-tool.exe -a verify-pin -a selfsign-certificate -s 9a -S “\/CN=hegars\/OU=hegars\/O=hegars.com\/” -i […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[6,7,8],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/posts\/112"}],"collection":[{"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=112"}],"version-history":[{"count":2,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/posts\/112\/revisions"}],"predecessor-version":[{"id":135,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=\/wp\/v2\/posts\/112\/revisions\/135"}],"wp:attachment":[{"href":"https:\/\/blog.hegars.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.hegars.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}