Installing pam_p11

Installation is quite easy:

wget http://www.opensc-project.org/files/pam_p11-0.1.tar.gz
tar xfvz pam_p11-0.1.tar.gz
cd pam_p11-0.1
./configure --prefix=/usr --libdir=/lib/
make
make install

is all you need. Pam_p11 depends on pkg-config, openssl, libp11 and pam. If you don't have pkg-config installed, please do so and try again. If pkg-config is not found, please change your PATH environment setting. If openssl is not installed, please do so. If openssl is not found, please change your PKG_CONFIG_PATH environment setting to include the directory with "openssl.pc" or "libp11.pc" file. Some linux distributions split openssl into a runtime package and a development package, you need to install both. Same might be true for pam and libp11.

Using pam_p11_opensc

To use pam_p11_opensc with some application like login, edit /etc/pam.d/login and replace

auth       required   pam_unix.so nullok

with

auth       required   pam_p11_opensc.so /usr/lib/opensc-pkcs11.so

Replace /usr/lib/opensc-pkcs11.so with your PKCS#11 implementation.

Also while testing it is best to keep a door open, i.e. allow also login via passwords. To try pam_p11_opensc first and then password put into your pam configuration:

auth       sufficient   pam_p11_opensc.so /usr/lib/opensc-pkcs11.so
auth       required   pam_unix.so nullok

Also each user needs to create a ~/.eid/ directory and create a file ~/.eid/authorized_certificates. You can do that via

mkdir ~/.eid
chmod 0755 ~/.eid
pkcs15-tool -r 45 > ~/.eid/authorized_certificates
chmod 0644 ~/.eid/authorized_certificates

This example uses the "pkcs15-tool" command from opensc to read the default user certificate (id 45) from the smart card in reader 0.

It is very important that only the user of the file can write to it. You can have any number of certificates in that file. The certificates need to be in "pem" format. "der" format is currently not supported.

Pam_p11_opensc is the successor of the OpenSC pam_opensc module (eid mode). It is 100% compatible, but has fewer bugs. Using pam_opensc is discouraged.

Using pam_p11_openssh

To use pam_p11_openssh with some application like login, edit /etc/pam.d/login and replace

auth       required   pam_unix.so nullok

with

auth       required   pam_p11_openssh.so /usr/lib/opensc-pkcs11.so

Replace /usr/lib/opensc-pkcs11.so with your PKCS#11 implementation.

Also while testing it is best to keep a door open, i.e. allow also login via passwords. To try pam_p11_opensc first and then password put into your pam configuration:

auth       sufficient   pam_p11_openssh.so /usr/lib/opensc-pkcs11.so
auth       required   pam_unix.so nullok

Also each user needs to create a ~/.ssh/ directory and create a file ~/.ssh/authorized_keys. You can do that via

mkdir ~/.ssh
chmod 0755 ~/.ssh
ssh-keygen -D 0 > ~/.ssh/authorized_keys
chmod 0644 ~/.ssh/authorized_keys

This example uses the "ssh-keygen" command from openssh to read the default user public key (id 45) from the smart card in reader 0. Note that this tool prints the public keys in two formats: ssh v1 and ssh v2 format. It is recommended to edit the file and delete one of those two lines. Also you might want to add a comment / identifier at the end of the line.

It is very important that only the user of the file can write to it. You can have any number of public keys in that file.

Note it is currently not possible to convert existing ssh keys into pem format and store them on a smart card. (To be precise: OpenSC has no such functionality, not sure about other implementations.)

Security Note

Both pam_p11 modules are plain, they simple compare rsa public keys and request the cryptographic token to sign some random data and verifiy the signature with the public key. No CA chain checking is done, no CRL is looked at, and they don't know what OCSP is. This works fine for small installations, but if you want any of those features, please have a look at Pam_pkcs11 for a fully fledged pam module for smart card authentication.