Home » GNU|Linux Smartcard logon using PAM_P11

Configuring Pam_P11

PAM configuration files are stored in the /etc/pam.d/ directory.

Let us have a look at the common-session configuration file:

$ cat /etc/pamd.d/common-auth

This displays:

$ # here are the per-package modules (the "Primary" block)
auth [success=1 default=ignore] pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# end of pam-auth-update config

As of pam 1.0.1-6, this file is managed by pam-auth-update by default.

To take advantage of this, it is recommended that you configure any local modules either before or after the default block, and use pam-auth-update to manage selection of other modules.

pam-config mechanism stores templates in /usr/share/pam-configs.

Let us explore this directory:

$ ls /usr/share/pam-configs
consolekit gnome-keyring unix

Now we simply create a template for pam_p11 login.
Create an empty file /usr/share/pam-configs/p11 and add:

Name: Pam_p11
Default: yes
Priority: 800
Auth-Type: Primary
Auth: sufficient pam_p11_openssh.so /usr/lib/opensc-pkcs11.so

To regenerate PAM configuration files, we need to execute:

$ pam-auth-update

A Debian configuration dialog is displayed:

Make sure 'Unix authentication' is enabled, otherwise there is a risk to lose the ability to connect using passwords.

Enable 'libpam-p11' and disable 'libpam-pkcs11' to avoid a separate access system using smart cards.

Let us have a look at the common-session configuration file:

$ cat /etc/pam.d/common-auth

This displays:

$ here are the per-package modules (the "Primary" block)
auth sufficient pam_p11_openssh.so /usr/lib/opensc-pkcs11.so
auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

Notice the line:

auth sufficient pam_p11_openssh.so /usr/lib/opensc-pkcs11.so
auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass
Bookmark/Search this post with