On Fri, Feb 14, 2020 at 03:27:40PM -0000, Leon Castellano via FreeIPA-users wrote:
Hi Alexander,
Here's what I'm seeing over Console:
ipaclient login: user
PIN for PIV_II:
ipaclient$ p11tool --list-tokens
Token 0:
URL:
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
Label: System Trust
Type: Trust module
Flags: uPIN uninitialized
Manufacturer: PKCS#11 Kit
Model: p11-kit-trust
Serial: 1
Module: p11-kit-trust.so
Token 1:
URL:
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=Default%20Trust
Label: Default Trust
Type: Trust module
Flags: uPIN uninitialized
Manufacturer: PKCS#11 Kit
Model: p11-kit-trust
Serial: 1
Module: p11-kit-trust.so
Token 2:
URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=<REDACTED>;token=PIV_II
Label: PIV_II
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: piv_II
Model: PKCS#15 emulated
Serial: <REDACTED>
Module: opensc-pkcs11.so
ipaclient$ modutil -dbdir /etc/pki/nssdb -list
Listing of PKCS #11 Modules
-----------------------------------------------------------
1. NSS Internal Crypto Services
uri:
pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.44
slots: 2 slots attached
status: loaded
slot: NSS Internal Cryptographic Services
token: NSS Generic Crypto Services
uri:
pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
slot: NSS User Private Key and Certificate Services
token: NSS Certificate DB
uri:
pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
2. p11-kit-proxy
library name: p11-kit-proxy.so
uri:
pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
slots: 2 slots attached
status: loaded
slot: SCM Microsystems Inc. SCR 3310 [CCID Interface] (<REDACTED>)
token: PIV_II
uri:
pkcs11:token=PIV_II;manufacturer=piv_II;serial=<REDACTED>;model=PKCS%2315%20emulated
slot: Broadcom Corp 5880 [Contacted SmartCard] (<REDACTED>) 01 00
token:
uri: pkcs11:
3.
slots: There are no slots attached to this module
status: Not loaded
4. p11-kit-client
library name: /usr/lib64/pkcs11/p11-kit-client.so
slots: There are no slots attached to this module
status: Not loaded
-----------------------------------------------------------
ipaclient$ sudo -i
PIN for PIV_II:
ipaclient#
Here's what I'm seeing over SSH:
local$ eval $(p11-kit server
'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=<REDACTED>;token=PIV_II')
local$ ssh -R /run/user/<REDACTED>/p11-kit/pkcs11:${P11_KIT_SERVER_ADDRESS#*=}
ipaclient
ipaclient$ p11tool --provider /usr/lib64/pkcs11/p11-kit-client.so --list-tokens
Token 0:
URL:
pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=<REDACTED>token=PIV_II
Label: PIV_II
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: piv_II
Model: PKCS#15 emulated
Serial: <REDACTED>
Module:
ipaclient$ modutil -dbdir /etc/pki/nssdb -list
Hi,
can you try the same commands as root, i.e. after logging in as the user
and checking that e.g. p11tool sees the token call
su -
and then as root:
p11tool --provider /usr/lib64/pkcs11/p11-kit-client.so --list-tokens
and
modutil -dbdir /etc/pki/nssdb -list
bye,
Sumit
Listing of PKCS #11 Modules
-----------------------------------------------------------
1. NSS Internal Crypto Services
uri:
pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.44
slots: 2 slots attached
status: loaded
slot: NSS Internal Cryptographic Services
token: NSS Generic Crypto Services
uri:
pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
slot: NSS User Private Key and Certificate Services
token: NSS Certificate DB
uri:
pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
2. p11-kit-client
library name: /usr/lib64/pkcs11/p11-kit-client.so
uri:
pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
slots: 1 slot attached
status: loaded
slot: SCR3310 Smart Card Reader
token: PIV_II
uri:
pkcs11:token=PIV_II;manufacturer=piv_II;serial=<REDACTED>;model=PKCS%2315%20emulated
3. p11-kit-proxy
library name: p11-kit-proxy.so
uri:
pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
slots: 1 slot attached
status: loaded
slot: SCR3310 Smart Card Reader
token: PIV_II
uri:
pkcs11:token=PIV_II;manufacturer=piv_II;serial=<REDACTED>;model=PKCS%2315%20emulated
4.
slots: There are no slots attached to this module
status: Not loaded
-----------------------------------------------------------
ipaclient$ sudo -i
[sudo] password for user:
I would really appreciate any guidance as to why over SSH "sudo" doesn't
see the card, even though p11tool sees it and the client module is NSS registered.
Thanks for your time,
-Leon
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...