openssh unix dev - Sep 2014 - Use safenet etoken with ssh-agent

Hi,

we are using eToken Pro Anywhere to connect with ssh. Basically this is 
working just fine, if you use ssh -I /lib/libeToken.so.8. But I need to 
be able to add the eToken to the ssh-agent due to ForwardAgent-Option. 
In our setup we use ssh-jumphosts from which you can connect to other 
hosts that are isolated from the workstation's network.

Unfortunately ssh-add -s /lib/libeToken.so.8 does not work. After 
entering the passphrase for PKCS#11, the operation fails with "Could not 
add card: /lib/libeToken.so.8". Is there any option to get mores details 
from ssh-add? I didn't find any debug mode I could turn on.

Btw. I'm using Ubuntu 14.04 amd64 with the OpenSSH_6.6.1, OpenSSL 1.0.1f 
6 Jan 2014.

Best regards,
Ben

On Sat, 13 Sep 2014, Benjamin Fras wrote:
> Hi,
> 
> we are using eToken Pro Anywhere to connect with ssh. Basically this is
> working just fine, if you use ssh -I /lib/libeToken.so.8. But I need to be
> able to add the eToken to the ssh-agent due to ForwardAgent-Option. In our
> setup we use ssh-jumphosts from which you can connect to other hosts that
are
> isolated from the workstation's network.
> 
> Unfortunately ssh-add -s /lib/libeToken.so.8 does not work. After entering
the
> passphrase for PKCS#11, the operation fails with "Could not add card:
> /lib/libeToken.so.8". Is there any option to get mores details from
ssh-add? I
> didn't find any debug mode I could turn on.
No, because all of the action happens in ssh-agent. You can run ssh-agent
in debugging mode though:

$ ssh-agent -d
SSH_AUTH_SOCK=/tmp/ssh-w2Q7ZYWsIZR5/agent.30154; export SSH_AUTH_SOCK;
echo Agent pid 30154;
$ env SSH_AUTH_SOCK=/tmp/ssh-w2Q7ZYWsIZR5/agent.30154 \
  ssh-add -s /lib/libeToken.so.8

-d