Hi everyone,
Good day to you all and I hope all is well.
I had a query please regarding setting up a smartcard reader with MATE.
I had tried setting up a smart card with Rocky Linux 8.10 on MATE, however was unsuccessful and wanted to also try using Ubuntu MATE 24.04. I asked for help, but received no reply (not a problem of course).
My goal is to be able to unlock and lock the desktop using a smart card with SSSD and PAM. This includes if the user locks their screen or if the screensaver is activated.
I initially would like to perform this for a local user and then expanding that to authenticating via LDAP using FreeIPA.
The reader I am using is a SCM Microsystems, Inc. SCR331-LC1 / SCR3310 SmartCard Reader, with a smartcard.
The output of lsusb:
Bus 001 Device 003: ID 04e6:5116 SCM Microsystems, Inc. SCR331-LC1 / SCR3310 SmartCard Reader
Output of opensc-tool --list-readers:
# Detected readers (pcsc)
Nr. Card Features Name
0 Yes SCM Microsystems Inc. SCR 3310 [CCID Interface] (53311947214780) 00 00
Output of pkcs15-tool --list-keys:
Using reader with a card: SCM Microsystems Inc. SCR 3310 [CCID Interface] (53311947214780) 01 00
Private RSA Key [User Authentication Key]
<KEY_INFO_HERE>
Private RSA Key [Digital Signature Key]
<KEY_INFO_HERE>
I am running a Ubuntu MATE 24.04 VM with virt-manager and the card reader is successfully passed through.
Running through the quick start guide for opensc, I am able to successfully find my card reader and detect my card when inserted.
For setting up the smartcard reader with MATE, I have been researching for guides on how to perform that, however there unfortunately is not much documentation available and the majority of guides show how to get a smart card working with GDM and the Gnome ecosystem.
For the foundation, I am following the Ubuntu documentation on how to set up a smart card reader with GDM and then diverting where appropriate for MATE. I am also using the similar desktop setup and Ubuntu Server guides for reference.
Steps that I have ran so far:
sudo apt update && sudo apt upgradesudo apt install opensc-pkcs11sudo apt install opensc- Went through the p11-kit documentation.
-
p11-kit list-modulessuccessfully shows that my smartcard is detected:
module: opensc-pkcs11
path: /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so
uri: pkcs11:library-description=OpenSC%20smartcard%20framework;library-manufacturer=OpenSC%20Project
library-description: OpenSC smartcard framework
library-manufacturer: OpenSC Project
library-version: 0.25
token: JPKI (User Authentication PIN)
token: JPKI (Digital Signature PIN)
-
pkcs15-tool --list-certificatesand observed certificates are present:
Using reader with a card: SCM Microsystems Inc. SCR 3310 [CCID Interface] (53311947214780) 00 00
X.509 Certificate [User Authentication Certificate]
<CERT_INFO_HERE>
X.509 Certificate [Digital Signature Certificate]
<CERT_INFO_HERE>
X.509 Certificate [User Authentication Certificate CA]
<CERT_INFO_HERE>
X.509 Certificate [Digital Signature Certificate CA]
-
Exported each certificate with
pkcs15-tool --read-certificate <ID_number> > <CERT_FILE>. -
Where I am stuck at the moment, is generating a self-signed certificate, using the smart card's private key. After further research, I had found a blog that goes into openssl and observed that a self-signed certificate can be generated:
Create a self-signed certificate from a smart card private key:
openssl req -new -x509 -engine pkcs11 -keyform engine -key "<rfc7512-uri>" ...
- When running the above command however, I receive:
Invalid engine "pkcs11"
40E74DDAB5780000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:../crypto/dso/dso_dlfcn.c:118:filename(/usr/lib/x86_64-linux-gnu/engines-3/pkcs11.so): /usr/lib/x86_64-linux-gnu/engines-3/pkcs11.so: cannot open shared object file: No such file or directory
40E74DDAB5780000:error:12800067:DSO support routines:DSO_load:could not load the shared library:../crypto/dso/dso_lib.c:152:
40E74DDAB5780000:error:13000084:engine routines:dynamic_load:dso not found:../crypto/engine/eng_dyn.c:442:
40E74DDAB5780000:error:13000074:engine routines:ENGINE_by_id:no such engine:../crypto/engine/eng_list.c:433:id=pkcs11
40E74DDAB5780000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:../crypto/dso/dso_dlfcn.c:118:filename(libpkcs11.so): libpkcs11.so: cannot open shared object file: No such file or directory
40E74DDAB5780000:error:12800067:DSO support routines:DSO_load:could not load the shared library:../crypto/dso/dso_lib.c:152:
40E74DDAB5780000:error:13000084:engine routines:dynamic_load:dso not found:../crypto/engine/eng_dyn.c:442:
No engine specified for loading private key
No filename or uri specified for loading
private key
- I do not have the
CA-Auth-cert.pemfile, which is why I am trying to create a self-signed CA certificate
If anyone has any experience with setting up a smart card with MATE (or with Gnome for that matter) and could assist with the above, that would be very appreciated please.
My apologies for not being able to post more links to the websites I referenced. Unfortunately being a new user, I cannot post more than 2 links.
Many thanks indeed and if I can help provide any outputs that are required, please don't hesitate to let me know and I will be more than happy to do so.
Aside from that, Ubuntu MATE is an excellent showcase of the MATE desktop, especially with the theming and colour selection. Please keep up the amazing work and thank you so much to the Ubuntu MATE maintainers for your tireless work!
, but based on an abstraction of the issue you are facing for your context.