From 95624e2c489969dea2c29f64bd739436c0822db1 Mon Sep 17 00:00:00 2001 From: Brice Gagnage Date: Tue, 4 Dec 2018 11:39:25 +0100 Subject: [PATCH] first draft --- README.md | 41 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 36 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 89e62b2..389878d 100644 --- a/README.md +++ b/README.md @@ -1415,17 +1415,48 @@ The goal here is to make the SSH client inside WSL work together with the Window ### Prerequisites - Install Ubuntu >16.04 for WSL - Install Kleopatra +- [Windows configuration](#windows) ### Windows configuration - In %APPDATA%/gnupg/scdaemon.conf, add `reader-port Yubico YubiKey OTP+FIDO+CCID 0` -- In %APPDATA%/gnupg/gpg-agent.conf, add -``` -enable-putty-support -enable-ssh-support -``` +- In %APPDATA%/gnupg/gpg-agent.conf, add `enable-ssh-support` - Open Kleopatra, go to Smartcard, plug your Yubikey, press F5. You should see your key's information. - Go back to the main screen, go to Import..., select your public key file. - Open a command console +- Type `gpg --card-status`, you should see your Yubikey's details. +- Follow this part: [Trust master key](#trust-master-key) + +### WSL configuration +- Download or clone [weasel-pageant](https://github.com/vuori/weasel-pageant) +- Add `eval $(/mnt/c//weasel-pageant -r -a /tmp/S.weasel-pageant)` to your .bashrc or equivalent +- Source it `. ~/.bashrc` +- You should be able to see your SSH key with `ssh-add -l` +- Edit your `~/.ssh/config` file +- For each host you want to use agent forwarding, add +``` +ForwardAgent yes +RemoteForward /tmp/S.weasel-pageant +``` +**Note**: the remote ssh socket path can be found by executing `gpgconf --list-dirs agent-ssh-socket` on the host. + +### Remote host configuration +- Add `export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)` to your .bashrc or equivalent +- Edit your /etc/ssh/sshd_config and add: +``` +AllowAgentForwarding yes +StreamLocalBindUnlink yes +``` + +### Final test +- Unplug your Yubikey, reboot. +- Log back on Windows, open a WSL console and enter `ssh-add -l`, you should see nothing. +- Plug your Yubikey, enter the same command, you should see your ssh key. +- Log in to your remote host, you should have the pinentry popup/window asking for your Yubikey pin. +- On your remote host, type `ssh-add -l`. If should see your ssh key, that means your forwarding works ! + +**Note**: you can chain the agent forwarding through multiple hosts, you just have to follow the same [protocol](#remote-host-configuration) to configure each host. + + # Troubleshooting