Tag: Linux

Secure administration of Linux systems includes avoiding SSH logons by password and instead logging on with RSA keys.

The de facto standard for SSH connections on Windows is PuTTY . Here, logon with RSA keys is implemented, but only key files can be used, which has the disadvantage that they are almost unprotected in the file system.

Surely a great option would be to use RSA keys from the Windows world, and perhaps even stored on a physical or virtual smart card.

Continue reading "Use SSH (PuTTY) on Windows with a certificate / smart card"

Assume the following scenario:

• A certificate request is made on a Linux system (for example, a thin client) by means of SSCEP against a Network Device Enrollment Service (NDES) .
• The certificate request fails with the following error message:

sscep: Subject of our request does not match that of the returned Certificate!

Continue reading "SSCEP: Subject of our request does not match that of the returned Certificate!"

If you want to equip a large number of systems with certificates, a manual request and renewal of the certificates is not an option. The only viable path is automation.

For systems that are not members of the Active Directory forest, an automatic certificate request via RPC/DCOM is not an option.

For certain use cases, the Simple Certificate Enrollment Protocol (SCEP) is an interesting alternative. For this protocol, there are clients not only for Windows but, with SSCEP, also for Linux. SSCEP is used, among others, by thin clients with the eLux operating system .

The following describes how to set up the SSCEP client on a Debian Buster Linux system - either to use it to manage servers or to be able to test the client-side behavior.

Continue reading "Install SSCEP for Linux (Debian Buster) and request certificates via the Network Device Enrollment Service (NDES)"