Serial readers should work fine on all operating systems. Usb needs hotplug support, so that you can plugin some new usb device, and if it is a smart card reader, openct needs to be notified. Unfortunatly hotplug on linux is currently moving from hotplug to udev or hald, so we document all three systems. Freebsd has usbd and dev, and no idea about all other systems.
Ubuntu Linux has a special problem: they bind-mount /dev/bus/usb to /proc/bus/usb, and as a result openct gets notified of new hardware and kernel/udev pass the device name of the file, but the file does not exist and will not be created, until openct event handler has finished. OpenCT 0.6.12 contains a work-around for this problem.
Linux kernel recently got much faster with improvements in the scheduler. This also triggers new race conditions in OpenCT. Starting with OpenC 0.6.12 wait for certain SYSFS properties and we sleep 100ms hoping the device will show up. But both might not always work. As new alternative we include a rules file for udev that uses the MODALIAS environment instead of SYSFS attributes and thus should work around those race conditions quite well.
Linux should work fine, and is tested all the time. Serial support needs nothing special (only the serial driver for your serial device), but usb support on linux has a few requirements:
usbfs /proc/bus/usb usbfs defaults 0 0
(replace "usbfs" with "usbdevfs" for linux kernel 2.4.* - will work on kernel 2.6.* too)
Unfortunatly the situation is no longer this easy. There are three new trends in linux/hotplug: 1.) replace hotplug shell scripts with udev. 2.) create usb device files in /dev/bus/usb/, obsolete /proc/bus/usb/ 3.) use hal in addition to udev, programs like openct should be called by hal.
The first trend is easy: we added a file "openct.udev" to etc/ in the source. Copy it into /etc/udev/rules/ as "95-openct.rules" and you should be fine. QuickStart has the details about it. Even if your system still uses hotplug this should be ok. Note you also need the files in /etc/hotplug/.
The second trend is ok: we changed openct so it works with either paths to the usb devices.
The third trend is difficult: So far hal has nearly no documentation at all, so we can't use it. Also it seems to have less functionality: while hotplug and udev have a mechanism to match any event against a list of what we are interested in, I have not seen anything like that in hal. So using hal would be very inefficient we guess. Also so far noone told us why we should change a running system. Till we learn more about it, hal remains a mysterious new technology.
Daniel Slezak reports for freebsd 5.4 :
I have sold a part of my problem by usbd in FreeBSD 5.4. I add to /etc/usbd.conf:
## Token Rainbow Technologies iKey 3000 Series device "iKey 3000 Series" devname "ugen[0-9]+" vendor 0x04b9 product 0x1300 attach "/usr/local/etc/rc.d/openct.sh start" detach "/usr/local/etc/rc.d/openct.sh stop" # The fallthrough entry: Nothing is specified, nothing is done. And it isn't # necessary at all :-) . Just for pretty printing in debugging mode. # device "USB device" detach "/usr/local/sbin/openct-control shutdown"
I has to add "detach /usr/local/etc/rc.d/openct.sh stop" in section "USB device" too, else it hasn't any effect. I have to close openct framework before I take out token. Else FreeBSD doesn't detach /dev/ugen0 and writes in logs: usb_detach_wait: ugen0 didn't detach.
And he forwarded a note from Petr Holub for FreeBSD 6.0:
On 6.0-RELEASE: 1) Install from ports security/openct security/opensc 2) add to /etc/devd.conf: # USB certificate token attach 50 { match "vendor" "0x04b9"; match "product" "0x1300"; action "/usr/local/etc/rc.d/openct.sh start"; }; detach 50 { match "vendor" "0x04b9"; match "product" "0x1300"; action "/usr/local/etc/rc.d/openct.sh stop"; }; 3) /etc/rc.d/devd restart
List of issues for FreeBSD:
/usr/sbin/openct-control attach /proc/bus/usb/003/002 usb:973/1which has the device path as parameter and "usb:vendor/product" so openct knows the type (usb) and the information (vendor and product) so it can read the openct.conf, look which driver is used for that, and start an ifdhandler like that:
/usr/sbin/ifdhandler -H egate /proc/bus/usb/003/003i.e. "-H" for hotplug, the driver name, and the device file to use. add -v or -vv or even more for debugging. would be nice if freebsd could do something similar, or let us know how to deal with this best.
install from ports cd /usr/ports/security/openct make install clean cd /usr/ports/security/opensc make install clean
Erase and key generation works so far, but openssl does not: the openssl shell exits after the engine load command for some unknown reason. Note you need to specify the engine shared object file as *.so.0.0 (on linux it is simply *.so).
Also OpenBSD has a hotplugd, but so far it does not support usb devices. So you need to run
openct-control shutdown openct-control init
every time you add or remove a usb crypto token.
Now OpenBSD Current (2005-07-20) passes all OpenSC regression tests with an Aladdin eToken PRO.
Other tokens however did not work, these problems need to be investigated, as well as how to get it to work without UGEN_DEBUG.
OpenCT should work, but this wasn't tested for sometime. Latest OpenCT seems to not find libusb, we are working on it.
Latest OpenCT supports Solaris fine and was tested to work.
Sunray including client/server architecture was recently added to OpenCT and 0.6.5 once release should work fine. Till then please use a snapshot or svn trunk checkout.