How can I use a certificate instead of login/password to access HPUX V3 running on blades?

[NavyYard]

Hi!

auditors want to access blade servers using certificate (CAC) instead of login ID / password to the server.

Is there a way to accomplish this task where auditors can login to these servers using Certificate on their CAC (Common Access Card).

What kind of additional hardware and software will be required to achive login with Cert?

Please advice.

Thanks

[Ken Grabowski]

You can use ssh-keygen to create an SSH public and private certificate.  Put the private key file in your /home/username/.ssh directory on your target system and put the public file in /home/username/.ssh on your source system(s).  If you are using strict security you will have to get the permissions correct on the file and directory for it to work.  .ssh directory should be 750 or less. The certificate file should be 440 or less.  You may have to adjust it as you test.

Now you should be able to use ssh username@targetsystem and connect without password.  If your systems subject to STIGS you may want to review them to make sure you're staying within compliance.

[Dennis Handly]

If you look at login(1) there is a mention of:

HP-UX Smart Card Login

But I'm not sure how that works?

[RenatoMartini]

To use a smart card (ISO 7816) & digital certifications in the Linux world is relatively easy, because we have a middleware (PC/SC), universal drivers to USB interface, and a set tools called OpenSC to manage a smart card and crypto token.

But I don't know if the HP-UX has a native support for devices like this.