Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

8.2. Connecting to sudo remotely using a smart card

Follow this procedure to configure the SSH agent and client to connect to sudo remotely using a smart card.

Prerequisites

  • You have created sudo rules in IdM.
  • You have configured IdM to support passkey authentication using FIDO2 Yubikeys or PKINIT authentication using smart cards.
  • You have configured the pam_sss_gss module for sudo authentication on the remote system where you are going to run sudo.

Procedure

  1. Start the SSH agent (if not already running). 

    # eval `ssh-agent`

  2. Add your smart card to the SSH agent. Enter your PIN when prompted: 

    # ssh-add -s /usr/lib64/opensc-pkcs11.so

  3. Connect to the system where you need to run sudo remotely by using SSH with ssh-agent forwarding enabled. Use the -A option: 

    # ssh -A ipauser1@server.ipa.test

Verification

  • Run the whoami command with sudo: 

    # sudo /usr/bin/whoami

You are not prompted for a PIN or password when the smart card is inserted.

注意

If the SSH agent is configured to use other sources, such as the GNOME Keyring, and you run the sudo command after removing the smart card, you might not be prompted for a PIN or password, as one of the other sources might provide access to a valid private key. To check the public keys of all identities known by the SSH agent, run the ssh-add -L command.

Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

Legal Notice

Theme

© 2026 Red Hat返回顶部