[gentoo-user] smartcard issues

April 16th, 2011 - 03:40 pm ET by deadeyes | Report spam
Hi all,

For logging in to servers we now use smartcards.
For windows this works fine, however for Linux and Mac OS X it doesn't.

The smartcards are from Raaktechnologies.
THis is the output of openct-tool atr:
Detected CCID Compatible
Card present, status changed
ATR: 3b f8 13 00 00 81 31 fe

So it seems that the card is detected.

HOwever when doing:
pkcs15-tool -D
[pkcs15-tool] reader-pcsc.c:896:pcsc_detect_readers:
SCardListReaders failed: 0x8010002e
[pkcs15-tool] reader-pcsc.c:1015:pcsc_detect_readers:
returning with: No readers found
Using reader with a card: CCID Compatible
[pkcs15-tool] reader-openct.c:324:openct_reader_transmit: unable to transmit
[pkcs15-tool] apdu.c:394:do_single_transmit: unable to transmit APDU
[pkcs15-tool] reader-openct.c:324:openct_reader_transmit: unable to transmit
[pkcs15-tool] apdu.c:394:do_single_transmit: unable to transmit APDU
[pkcs15-tool] card-default.c:66:autodetect_class:
APDU transmit failed: Generic reader error
[pkcs15-tool] card-default.c:113:default_init:
unable to determine the right class byte
[pkcs15-tool] card.c:202:sc_connect_card: driver 'Default driver
for unknown cards' init() failed: Card is invalid or cannot be handled
[pkcs15-tool] card.c:213:sc_connect_card:
unable to find driver for inserted card
[pkcs15-tool] card.c:228:sc_connect_card: returning with:
Card is invalid or cannot be
Failed to connect to card: Card is invalid or cannot be handled

I think that this tool has no driver for reading this card.

They supplied me with a library: libcmP11.so.
I tried adding it to opensc.conf and
got a message that it was not a valid driver.

Using pkcs11-tool:

pkcs11-tool -I \

Cryptoki version 2.11
Manufacturer charismathics gmbh
Library cm PKCS#11 module (ver 4.8)
No slots.

So it seems that this is a pkcs11 library.
However I always get no slots and it
isn't usable on any rdesktop connection.

I have following packages and there use flags:
net-misc/rdesktop-1.6.0-r4 alsa ipv6 pcsc-lite rdpusb
dev-libs/openct-0.6.20-r1 Upcsc-lite usb
dev-libs/opensc-0.11.13-r2 openct pcsc-lite readline ssl zlib
sys-apps/pcsc-lite-1.7.2-r1 USE="(-usb)"

ldd of the library shows that all dependencies are met.

I have to say I have no experience using smartcards and
I am not sure how the different tools interact:
opensc-tool openct-tool pcscd pkcs11-tool pkcs15-tool,...

In the end what should be possible is login to an rdesktop connection.
On my previous portable I came somewhere
I actually could type in my pin code
(on the remote desktop) however after that it failed.
Now I can't even got it to work to that stage.

The SmartCard reader I have is one that is internally connected through usb:
Bus 002 Device 005: ID 0a5c:5801 Broadcom Corp. BCM5880
Secure Applications Processor with fingerprint swipe sensor

All help/troubleshooting tips/... are welcome!
Thanks in advance!
email Follow the discussionReplies 1 replyReplies Make a reply

Replies

#1 deadeyes
April 26th, 2011 - 10:40 am ET | Report spam
deadeyes <gvm999 <at> gmail.com> writes:


Hi all,

For logging in to servers we now use smartcards.
For windows this works fine, however for Linux and Mac OS X it doesn't.




After waisting alot of time I found out the following things (I hope sooner or
later it will help someone else):
- for smartcard using through rdesktop you don't need a driver for the card
- you don't need to do anything with openct-tool/openct-control
- If openct has started stop it and disable it, also kill all ifdhandler
processes, you don't need them
- just use pcscd -d -f and then plug in your smartcard reader
- When started you will see the light flashing on your smartcard reader
- on 32 bit it seems to work fine.. however on my AMD64 it did not BUT
- setup a 32 bit chroot (as described in the gentoo chroot 32bit howto) and
emerge rdesktop (with smartcard support) and pcsc-lite. (or using quickpkg)
- Now get the files from the package or from the 32bit chroot itself
(/usr/bin/rdesktop and /usr/lib/libpcsclite.so.1) and copy them over to your 64
bit environment. I recommend putting /usr/lib/libpcsclite.so.1 in /usr/lib32/ on
your 64bit environment. (Do note that everything else is 64 bit, so your
driver/bundle for openct as well)

I'll add any further info if necessary.

Similar topics