Home » GNU|Linux smartcard logon using PAM-PKCS11

OpenSC user mapper

Notice these lines in /etc/pam_pkcs11/pam_pkcs11.conf:

# Search certificates from $HOME/.eid/authorized_certificates to match users
mapper opensc {
debug = false;
module = /usr/lib/pam_pkcs11/opensc_mapper.so;
}

The module path is wrong on Debian systems, it should be:

module = /lib/pam_pkcs11/opensc_mapper.so;

Configure PAM-pkcs11 to use OpenSC mapper.

Edit /etc/pam_pkcs11/pam_pkcs11.conf

use_mappers = opensc, null;

In each user directory, create an .eid folder:

$ mkdir -p ~/.eid
$ chmod og= ~/.eid

Query X.509 certificates on your smartcard:

$ pkcs15-tool --list-certificates
Using reader with a card: Feitian SCR301 01 00
X.509 Certificate
Flags : 2
Authority: no
Path : 3f0050153100
ID : 7645d913d5b4e03f3fe54816ff02324c23a7ebf4

Extract the X.509 certificate with ID 7645d913d5b4e03f3fe54816ff02324c23a7ebf4 to /.eid/authorized_certificates:

$ pkcs15-tool --read-certificate 7645d913d5b4e03f3fe54816ff02324c23a7ebf4 -o ~/.eid/authorized_certificates
Bookmark/Search this post with