<div dir="ltr">Thank you.<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Dec 29, 2017 at 12:59 AM, Matthias Apitz <span dir="ltr"><<a href="mailto:guru@unixarea.de" target="_blank">guru@unixarea.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
How to use the OpenPGP Card to unlock the KDE desktop<br>
Matthias Apitz <<a href="mailto:guru@unixarea.de">guru@unixarea.de</a>><br>
Thu Dec 28 20:07:19 CET 2017<br>
<br>
Based on: gpg (GnuPG) 2.1.19 and poldi VERSION 0.4.2.git<br>
<br>
<br>
I'm using the OpenPGP Card (among other things) to lock my KDE desktop<br>
when the card is withdrawn. This is easy to be done from the script<br>
${GNUPGHOME}/scd-event which fires up the KDE proc<br>
<br>
...<br>
nohup /usr/local/lib/kde4/libexec/<wbr>kscreenlocker_greet --immediateLock &<br>
...<br>
<br>
to lock the desktop until the correct password is provided. 'kscreenlocker_greet'<br>
uses /usr/local/lib/kde4/libexec/<wbr>kcheckpass to check the credentials<br>
with PAM using the rules file /usr/local/etc/pam.d/kde which has the pointer<br>
to the shared lib to use for this:<br>
<br>
$ grep auth /usr/local/etc/pam.d/kde<br>
auth required pam_unix.so no_warn try_first_pass<br>
<br>
What I do want here is, that the authentication is not done against the UNIX<br>
(FreeBSD) password database, but against the OpenPGP Card's key, i.e. requires the<br>
correct PIN of the card to be entered as password in 'kscreenlocker_greet'.<br>
<br>
Here are the details of installation and configuration.<br>
<br>
<br>
Installation:<br>
<br>
$ git clone <a href="https://github.com/gpg/poldi.git" rel="noreferrer" target="_blank">https://github.com/gpg/poldi.<wbr>git</a><br>
$ cd poldi<br>
$ ./autogen.sh<br>
$ ./configure --enable-maintainer-mode<br>
$ gmake<br>
# gmake install<br>
<br>
There are some issues/bugs in poldi's sources on FreeBSD:<br>
<br>
1) in subdir tests/<br>
<br>
$ diff pam-test.c.orig pam-test.c<br>
23c23<br>
< #include <security/pam_misc.h><br>
---<br>
> #include <security/openpam.h><br>
38c38<br>
< misc_conv,<br>
---<br>
> openpam_ttyconv,<br>
<br>
and remove '-lpam_misc' from Makefile<br>
<br>
2) in src/assuan/ add funopen.c and funopen.o to the Makefile<br>
<br>
$ grep -n funopen src/assuan/Makefile<br>
144: assuan-socket.$(OBJEXT) funopen.$(OBJEXT)<br>
343: assuan-buffer.c funopen.c \<br>
<br>
<br>
3) in conf/Makefile the calls to hard 'install' must be changed to:<br>
<br>
INSTALL = $(install_sh) -c (line 8)<br>
and called as $(INSTALL) (line 465 ff)<br>
after this, the 'gmake install-conf-skeleton' installs the files into<br>
/usr/local/etc/poldi/...<br>
<br>
4) the pam_poldi.so is search in /usr/local/lib and not in /usr/local/lib/security<br>
we make a sym link:<br>
<br>
# ln -s /usr/local/lib/security/pam_<wbr>poldi.so /usr/local/lib/pam_poldi.so<br>
<br>
5) the log file will be written as normal user, use chown or chmod 0666<br>
<br>
# touch /var/log/poldi<br>
# chown guru /var/log/poldi<br>
<br>
<br>
Configuration details:<br>
<br>
# vim /usr/local/etc/poldi/poldi.<wbr>conf<br>
<br>
auth-method localdb<br>
log-file /var/log/poldi<br>
debug<br>
# Specify SCDaemon executable<br>
scdaemon-program /usr/local/libexec/scdaemon<br>
<br>
$ gpg --card-status | grep 'Application ID'<br>
<br>
Application ID ...: D27600012401020100050000532B00<wbr>00<br>
<br>
# vim /usr/local/etc/poldi/localdb/<wbr>users<br>
<br>
D27600012401020100050000532B00<wbr>00 guru<br>
<br>
# touch /usr/local/etc/poldi/localdb/<wbr>keys/<wbr>D27600012401020100050000532B00<wbr>00<br>
# chown guru /usr/local/etc/poldi/localdb/<wbr>keys/<wbr>D27600012401020100050000532B00<wbr>00<br>
<br>
For tests we create our own file 'myked' in /usr/local/etc/pam.d/:<br>
<br>
# cp /usr/local/etc/pam.d/kde /usr/local/etc/pam.d/mykde<br>
# grep auth /usr/local/etc/pam.d/mykde<br>
auth required pam_poldi.so<br>
(note: additional args to 'pam_poldi.so' gives PAM parse error)<br>
<br>
<br>
Now we insert the key in the local key database as user 'guru' with:<br>
<br>
$ gpg-connect-agent "/datafile /usr/local/etc/poldi/localdb/<wbr>keys/<wbr>D27600012401020100050000532B00<wbr>00" "SCD READKEY --advanced OPENPGP.3" /bye<br>
OK<br>
$ ls -l /usr/local/etc/poldi/localdb/<wbr>keys/<wbr>D27600012401020100050000532B00<wbr>00<br>
-rw-r--r-- 1 guru wheel 1077 28 dic. 09:48 /usr/local/etc/poldi/localdb/<wbr>keys/<wbr>D27600012401020100050000532B00<wbr>00<br>
$ file /usr/local/etc/poldi/localdb/<wbr>keys/<wbr>D27600012401020100050000532B00<wbr>00<br>
/usr/local/etc/poldi/localdb/<wbr>keys/<wbr>D27600012401020100050000532B00<wbr>00: ASCII text, with very long lines<br>
<br>
For some first tests we run:<br>
<br>
(re-insert the card first)<br>
<br>
$ tests/pam-test mykde -u guru<br>
Insert authentication card for user `guru'<br>
Trying authentication as user `guru'...<br>
Please unlock the card<br>
<br>
Number: 0005 0000532B<br>
Holder: Matthias Apitz (<< here it asks for the PIN of the Card)<br>
Authentication succeeded<br>
Authenticated as user `guru'<br>
<br>
# tail -f /var/log/poldi<br>
Poldi 2017-12-28 10:51:35 [10785] debug: using authentication method `localdb'<br>
Poldi 2017-12-28 10:51:35 [10785] debug: got scdaemon socket name from gpg-agent, connected to socket '/home/guru/.gnupg-ccid/S.<wbr>scdaemon'<br>
Poldi 2017-12-28 10:51:35 [10785] debug: Waiting for card for user `guru'...<br>
Poldi 2017-12-28 10:51:35 [10785] debug: connected to card; serial number is: D27600012401020100050000532B00<wbr>00<br>
Poldi 2017-12-28 10:51:35 [10785] debug: Trying authentication as user `guru'...<br>
Poldi 2017-12-28 10:51:48 [10785] debug: authentication succeeded<br>
<br>
In case of errors check also /var/log/messages<br>
<br>
<br>
Now the changes for "real world" KDE:<br>
<br>
# cp -p /usr/local/etc/pam.d/kde /usr/local/etc/pam.d/kde.orig<br>
# vim /usr/local/etc/pam.d/kde<br>
<br>
auth required pam_poldi.so<br>
(note: additional args to 'pam_poldi.so' gives PAM parse error)<br>
<br>
set the environment in ~/.xinitrc as<br>
<br>
$ cat ~/.xinitrc<br>
. ~/ccid.sh<br>
setxkbmap -option terminate:ctrl_alt_bksp<br>
xmodmap -e "keycode 174 = F21" # volume down<br>
xmodmap -e "keycode 176 = F22" # volume up<br>
xmodmap -e "keycode 140 = F23" # volume mute<br>
exec /usr/local/bin/startkde<br>
<br>
$ cat ~/ccid.sh<br>
# kill the ssh-agent<br>
#<br>
ssh-agent -k 2> /dev/null<br>
# set GNUPGHOME<br>
#<br>
GNUPGHOME=/home/guru/.gnupg-<wbr>ccid<br>
export GNUPGHOME<br>
# set SSH_AUTH_SOCK<br>
#<br>
unset SSH_AGENT_PID<br>
unset SSH_AUTH_SOCK<br>
SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)";<br>
export SSH_AUTH_SOCK<br>
<br>
# start the gpg-agent<br>
#<br>
gpg-connect-agent /bye<br>
<br>
<br>
Restart KDE.<br>
<br>
Now withdrawing the card locks the screen by firing up from ${GNUPGHOME}/scd-event<br>
the screen locker.<br>
<br>
And I can unlock the screen only by inserting the OpenPGP card and<br>
entering the correct PIN.<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
--<br>
Matthias Apitz, ✉ <a href="mailto:guru@unixarea.de">guru@unixarea.de</a>, ⌂ <a href="http://www.unixarea.de/" rel="noreferrer" target="_blank">http://www.unixarea.de/</a> 📱 <a href="tel:%2B49-176-38902045" value="+4917638902045">+49-176-38902045</a><br>
Public GnuPG key: <a href="http://www.unixarea.de/key.pub" rel="noreferrer" target="_blank">http://www.unixarea.de/key.pub</a><br>
</font></span></blockquote></div><br></div>