<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
/* Page Definitions */
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ZH-CN" link="#0563C1" vlink="#954F72" style="text-justify-trim:punctuation">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I configured /etc/pam.d/su on Redhat6.6 64bit to do authentication by PIV smartcard:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none">
<tbody>
<tr>
<td width="575" valign="top" style="width:431.5pt;border:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="MsoNormal"><span lang="EN-US">vi /etc/pam.d/su<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">#%PAM-1.0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">auth sufficient pam_rootok.so<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">auth sufficient pam_pkcs11.so debug<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Also I replace the module with vender’s:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">vi /etc/pam_pkcs11/pam_pkcs11.conf:<o:p></o:p></span></p>
<table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none">
<tbody>
<tr>
<td width="575" valign="top" style="width:431.5pt;border:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="MsoNormal"><span lang="EN-US"> pkcs11_module coolkey {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> module = /usr/lib64/pkcs11/libcmP11.so;<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Everything works well within the original pcsc-lite-1.5.2 until I downloaded and updated pcsc-lite to 1.7.4(<a href="https://alioth.debian.org/frs/?group_id=30105#title_pcsclite">https://alioth.debian.org/frs/?group_id=30105#title_pcsclite</a>)
manually. Below is my steps:<o:p></o:p></span></p>
<table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none">
<tbody>
<tr>
<td width="575" valign="top" style="width:431.5pt;border:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="MsoNormal"><span lang="EN-US">./configure –prefix=/usr/<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">make<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">make install<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">service pcscd restart<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[root@redhat-66-sc-login pcsc-lite-1.7.4]# pcscd -v<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">pcsc-lite version 1.7.4.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Copyright (C) 1999-2002 by David Corcoran <corcoran@linuxnet.com>.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Copyright (C) 2001-2011 by Ludovic Rousseau <ludovic.rousseau@free.fr>.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Copyright (C) 2003-2004 by Damien Sauveron <sauveron@labri.fr>.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Report bugs to <muscle@lists.musclecard.com>.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Enabled features: Linux x86_64-unknown-linux-gnu usbdropdir=/usr/lib64/pcsc/drivers ipcdir=/var/run configdir=/etc/<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Then I found smartcard PAM authentication always failed:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[renz@redhat-66-sc-login pcsc-lite-1.7.4]$ su<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pam_config.c:238: Using config file /etc/pam_pkcs11/pam_pkcs11.conf<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pkcs11_lib.c:182: Initializing NSS ...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pkcs11_lib.c:192: Initializing NSS ... database=/etc/pki/nssdb<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pkcs11_lib.c:210: ... NSS Complete<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pam_pkcs11.c:272: Is it a screen saver?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pam_pkcs11.c:287: explicit username = [root]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pam_pkcs11.c:315: loading pkcs #11 module...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pkcs11_lib.c:235: Looking up module in list<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pkcs11_lib.c:238: modList = 0x4eb443d0 next = 0x0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pkcs11_lib.c:239: dllName= <null> <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pkcs11_lib.c:285: loading Module explictly, moduleSpec=<library="/usr/lib64/pkcs11/libcmP11.so" name="SmartCard"> module=/usr/lib64/pkcs11/libcmP11.so<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">DEBUG:pkcs11_lib.c:289: Failed to load SmartCard software (null)<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="color:red;background:yellow;mso-highlight:yellow">ERROR:pam_pkcs11.c:318: load_pkcs11_module() failed:</span><span lang="EN-US" style="color:red"><o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-US" style="color:red"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US">Does anyone have any idea about this issue? Thanks in advance!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Zhaohan<o:p></o:p></span></p>
</div>
</body>
</html>