1

I tried to implement a smart card authentication in a Samba4 domain (Samba AD). Currently I have two domain controllers (CentOS), a file server and several clients (CentOS and Windows). In regards to the smart card, I have a "Téo by Xiring" card reader and a "Gemalto IDPrime 510 (.Net V3)" card. I also have the appropriate drivers and I can authenticate with a smart card on Windows but It's not possible on CentOS.

The smart card reader and the card seem recognized by CentOS (present in lsusb -v and inserting the card launches "Smart Card Manager" but informs that the certificate isn't known and the card not formatted). However using the module libgtop11dotnet I can read the certificate and even connect (with the corresponding PIN) using pkcs11-tool (but I must specify the module). In spite of all this, it is impossible for me to login on CentOS using the smart card. Even by forcing the use of the smart card to logon, nothing happens. Is there a special modification to be on pam_pkcs11 or Kerberos to specify which module to use or to link the user certificate with the domain user ?

All commands like : opensc-tool -n, pklogin_finder debug, pkcs11_inspect debug et pkcs11_listcerts debug return an error.

Commands :

[MYDOMAIN\administrator@Client1 ~]$ pkcs11-tool --module=/usr/local/lib/libgtop11dotnet.so -l -O
Using slot 0 with a present token (0x0)
Logging in to ".NET #514CA4DC28D2DF4D".
Please enter User PIN:
Certificate Object; type = X.509 cert
  label:      a1b062f9-7bfd-af90-3d7e-61cfd2105a0a
  ID:         a1b062f97bfdaf903d7e61cfd2105a0a145fec47
Public Key Object; RSA 2048 bits
  label:      a1b062f9-7bfd-af90-3d7e-61cfd2105a0a
  ID:         a1b062f97bfdaf903d7e61cfd2105a0a145fec47
  Usage:      encrypt, verify
Private Key Object; RSA
  label:      a1b062f9-7bfd-af90-3d7e-61cfd2105a0a
  ID:         a1b062f97bfdaf903d7e61cfd2105a0a145fec47
  Usage:      decrypt, sign


[MYDOMAIN\administrator@Client1 ~]$ modutil -list -dbdir /etc/pki/nssdb
Listing of PKCS #11 Modules
-----------------------------------------------------------
  1. NSS Internal PKCS #11 Module
         slots: 2 slots attached
        status: loaded

         slot: NSS Internal Cryptographic Services
        token: NSS Generic Crypto Services

         slot: NSS User Private Key and Certificate Services
        token: NSS Certificate DB

  2. libgtop11dotnet
        library name: /usr/local/lib/libgtop11dotnet.so
         slots: 5 slots attached
        status: loaded

         slot: XIRING Teo 00 00
        token: .NET #514CA4DC28D2DF4D

         slot: empty
        token:

         slot: empty
        token:

         slot: empty
        token:

         slot: empty
        token:
-----------------------------------------------------------


[MYDOMAIN\administrator@Client1 ~]$ opensc-tool -l
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             XIRING Teo 00 00


[MYDOMAIN\administrator@Client1 ~]$ pcsc_scan
PC/SC device scanner
V 1.4.25 (c) 2001-2011, Ludovic Rousseau <[email protected]>
Compiled with PC/SC lite version: 1.8.8
Using reader plug'n play mechanism
Scanning present readers...
0: XIRING Teo 00 00

Tue Sep 25 07:18:18 2018
Reader 0: XIRING Teo 00 00
  Card state: Card inserted, Shared Mode,
  ATR: 3B 16 96 41 73 74 72 69 64

ATR: 3B 16 96 41 73 74 72 69 64
+ TS = 3B --> Direct Convention
+ T0 = 16, Y(1): 0001, K: 6 (historical bytes)
  TA(1) = 96 --> Fi=512, Di=32, 16 cycles/ETU
    250000 bits/s at 4 MHz, fMax for Fi = 5 MHz => 312500 bits/s
+ Historical bytes: 41 73 74 72 69 64
  Category indicator byte: 41 (proprietary format)

Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
3B 16 96 41 73 74 72 69 64
        Gemalto .NET v2.0


[MYDOMAIN\administrator@Client1 ~]$ opensc-tool -n
Using reader with a card: XIRING Teo 00 00
Unsupported card


[MYDOMAIN\administrator@Client1 ~]$ pkcs11_listcerts debug
DEBUG:pam_config.c:238: Using config file /etc/pam_pkcs11/pam_pkcs11.conf
DEBUG:pkcs11_lib.c:182: Initializing NSS ...
DEBUG:pkcs11_lib.c:192: Initializing NSS ... database=/etc/pki/nssdb
DEBUG:pkcs11_lib.c:210: ...  NSS Complete
DEBUG:pkcs11_listcerts.c:69: loading pkcs #11 module...
DEBUG:pkcs11_lib.c:235: Looking up module in list
DEBUG:pkcs11_lib.c:238: modList = 0x21a49c0 next = 0x21bf3c0

DEBUG:pkcs11_lib.c:239: dllName= <null>

DEBUG:pkcs11_lib.c:238: modList = 0x21bf3c0 next = 0x0

DEBUG:pkcs11_lib.c:239: dllName= libgtop11dotnet.so

DEBUG:pkcs11_listcerts.c:77: initialising pkcs #11 module...
DEBUG:pkcs11_listcerts.c:94: no token available

Thanks in advance.

9
  • 1
    Does pkcs11-tool show the certificates without the -l option? Sep 25, 2018 at 8:27
  • Yep, from the moment I specify the module this command works fine. I just don't have the last part : [MYDOMAIN\administrator@Client1 ~]$ pkcs11-tool --module=/usr/local/lib/libgtop11dotnet.so -O Using slot 0 with a present token (0x0) Certificate Object; type = X.509 cert label: a1b062f9-7bfd-af90-3d7e-61cfd2105a0a ID: a1b062f97bfdaf903d7e61cfd2105a0a145fec47 Public Key Object; RSA 2048 bits label: a1b062f9-7bfd-af90-3d7e-61cfd2105a0a ID: a1b062f97bfdaf903d7e61cfd2105a0a145fec47 Usage: encrypt, verify
    – Lesuno
    Sep 25, 2018 at 9:49
  • pam_pkcs11 is used to log into the local machine. You may need to use a pam_krrb5. Kerberos uses PKINT to authenticate using smartcard to the domain controller (KDC) Sep 27, 2018 at 17:34
  • Have you looked at; centos.org/docs/5/html/5.1/Deployment_Guide/… Sep 27, 2018 at 17:35
  • To see what is going on with the PKCS#11 you can use the OpenSC SPY It is a PKCS#11 module that loads another PKCS#11 module. Sep 27, 2018 at 17:38

0

You must log in to answer this question.

Browse other questions tagged .