Skip to main content

Gnome smartcard screen locking

For security, it may be useful to lock the screen when the card is removed.

Modify this file: /etc/pam_pkcs11/card_eventmgr.conf

pkcs11_eventmgr {

# Run in background? Implies debug=false if true
daemon = true;

# show debug messages?
debug = false;

# polling time in seconds
polling_time = 1;

# expire time in seconds
# default = 0 ( no expire )
expire_time = 0;

# pkcs11 module to use
pkcs11_module = /usr/lib/opensc-pkcs11.so;

#
# list of events and actions

# Card inserted
event card_insert {
# what to do if an action fail?
# ignore : continue to next action
# return : end action sequence
# quit : end program
on_error = ignore ;

# You can enter several, comma-separated action entries
# they will be executed in turn
action = "gnome-screensaver-command --poke";
}

# Card has been removed
event card_remove {
on_error = ignore;
action = "gnome-screensaver-command --lock";
}

# Too much time card removed
event expire_time {
on_error = ignore;
action = "/bin/false";
}
}

If you would like a more granular configuration based on users:

You may specify in /etc/pam_pkcs11/card_eventmgr.conf

pkcs11_eventmgr {
nodebug
nodaemon
polling_time=5
config_file=${HOME}/.pkcs11_eventmgr.conf
}

And move .pkcs11_eventmgr.conf in each user directory.