Hi Alexander,
Here's what I'm seeing over Console:
ipaclient login: user
PIN for PIV_II:
ipaclient$ p11tool --list-tokens
Token 0:
URL:
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
Label: System Trust
Type: Trust module
Flags: uPIN uninitialized
Manufacturer: PKCS#11 Kit
Model: p11-kit-trust
Serial: 1
Module: p11-kit-trust.so
Token 1:
URL:
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=Default%20Trust
Label: Default Trust
Type: Trust module
Flags: uPIN uninitialized
Manufacturer: PKCS#11 Kit
Model: p11-kit-trust
Serial: 1
Module: p11-kit-trust.so
Token 2:
URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=<REDACTED>;token=PIV_II
Label: PIV_II
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: piv_II
Model: PKCS#15 emulated
Serial: <REDACTED>
Module: opensc-pkcs11.so
ipaclient$ modutil -dbdir /etc/pki/nssdb -list
Listing of PKCS #11 Modules
-----------------------------------------------------------
1. NSS Internal Crypto Services
uri:
pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.44
slots: 2 slots attached
status: loaded
slot: NSS Internal Cryptographic Services
token: NSS Generic Crypto Services
uri:
pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
slot: NSS User Private Key and Certificate Services
token: NSS Certificate DB
uri:
pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
2. p11-kit-proxy
library name: p11-kit-proxy.so
uri:
pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
slots: 2 slots attached
status: loaded
slot: SCM Microsystems Inc. SCR 3310 [CCID Interface] (<REDACTED>)
token: PIV_II
uri:
pkcs11:token=PIV_II;manufacturer=piv_II;serial=<REDACTED>;model=PKCS%2315%20emulated
slot: Broadcom Corp 5880 [Contacted SmartCard] (<REDACTED>) 01 00
token:
uri: pkcs11:
3.
slots: There are no slots attached to this module
status: Not loaded
4. p11-kit-client
library name: /usr/lib64/pkcs11/p11-kit-client.so
slots: There are no slots attached to this module
status: Not loaded
-----------------------------------------------------------
ipaclient$ sudo -i
PIN for PIV_II:
ipaclient#
Here's what I'm seeing over SSH:
local$ eval $(p11-kit server
'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=<REDACTED>;token=PIV_II')
local$ ssh -R /run/user/<REDACTED>/p11-kit/pkcs11:${P11_KIT_SERVER_ADDRESS#*=}
ipaclient
ipaclient$ p11tool --provider /usr/lib64/pkcs11/p11-kit-client.so --list-tokens
Token 0:
URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=<REDACTED>token=PIV_II
Label: PIV_II
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: piv_II
Model: PKCS#15 emulated
Serial: <REDACTED>
Module:
ipaclient$ modutil -dbdir /etc/pki/nssdb -list
Listing of PKCS #11 Modules
-----------------------------------------------------------
1. NSS Internal Crypto Services
uri:
pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.44
slots: 2 slots attached
status: loaded
slot: NSS Internal Cryptographic Services
token: NSS Generic Crypto Services
uri:
pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
slot: NSS User Private Key and Certificate Services
token: NSS Certificate DB
uri:
pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
2. p11-kit-client
library name: /usr/lib64/pkcs11/p11-kit-client.so
uri:
pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
slots: 1 slot attached
status: loaded
slot: SCR3310 Smart Card Reader
token: PIV_II
uri:
pkcs11:token=PIV_II;manufacturer=piv_II;serial=<REDACTED>;model=PKCS%2315%20emulated
3. p11-kit-proxy
library name: p11-kit-proxy.so
uri:
pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
slots: 1 slot attached
status: loaded
slot: SCR3310 Smart Card Reader
token: PIV_II
uri:
pkcs11:token=PIV_II;manufacturer=piv_II;serial=<REDACTED>;model=PKCS%2315%20emulated
4.
slots: There are no slots attached to this module
status: Not loaded
-----------------------------------------------------------
ipaclient$ sudo -i
[sudo] password for user:
I would really appreciate any guidance as to why over SSH "sudo" doesn't see
the card, even though p11tool sees it and the client module is NSS registered.
Thanks for your time,
-Leon