Operating Systems: General Notes

Serial readers should work fine on all operating systems. USB needs hotplug support, so that you can plugin some new USB device, and if it is a smart card reader, OpenCT needs to be notified. Unfortunatly hotplug on Linux is currently moving from hotplug to udev or hald, so we document all three systems. FreeBSD has usbd and dev, and no idea about all other systems. Readers in PCMCIA and PC-Card format are experimental and only supported under Linux so far, tested only with the udev setup (but adapting the setup should be easy).

Linux

We will discuss the very old hotplug setup below which nearly noone uses these days, the current udev setup and problems we know with it, and the new hald setup.

Old Hotplug Setup

Serial support needs nothing special (only the serial driver for your serial device), but USB support on Linux has a few requirements:

Also the hotplug files need to be installed (see QuickStart for full installation instructions):

# cp etc/openct.usermap /etc/hotplug/usb/openct.usermap
# cp etc/openct_usb /etc/hotplug/usb/openct

New udev Setup

Serial support needs nothing special (only the serial driver for your serial device), but USB support on Linux has a few requirements:

OpenCT before 0.6.13 also needs:

Also the udev files need to be installed (see QuickStart for full installation instructions):

# cp etc/openct.udev /etc/udev/rules.d/50-openct.rules
# cp etc/openct_usb /lib/udev/openct_usb
# cp etc/openct_pcmcia /lib/udev/openct_pcmcia
# cp etc/openct_serial /lib/udev/openct_serial

Some common problems with udev:

mdev setup

mdev is provided by busybox to handle hotplug events as udev replacement. It is handy for initramfs configurations.

In order to setup configuration:

hald setup

Hald needs a fdi config file and a script it runs when something in the fdi config file matches. To install these files:

# mkdir -p /usr/share/hal/fdi/information/10freedesktop/
# cp etc/openct.fdi /usr/share/hal/fdi/information/10freedesktop/10-usb-openct.fdi
# cp etc/openct.hald /usr/bin/hald-addon-openct

OpenSuse ships OpenCT connected via hald to the kernel events. The fdi config file for hald in openct-0.6.12-10 however does not match USB class information and thus will not work with all readers. Also the hald-addon-openct in openct-0.6.12-10 seems to be broken, as it uses /proc/bus/usb/ PATH, but as far as we know OpenSuse only has devices in /dev/bus/usb.

OpenCT 0.6.13+ comes with a hald fdi file and we hope the packages OpenSuse creates for this new version will work.

PCMCIA and PC-Card readers are not yet supported via hald, advice and patches are very welcome.

Hald documentation is available online at http://people.freedesktop.org/~david/hal-spec/hal-spec.html

FreeBSD

Daniel Slezak reports for freebsd 5.4:

I have sold a part of my problem by usbd in FreeBSD 5.4. I add to /etc/usbd.conf:

## Token Rainbow Technologies iKey 3000 Series
device "iKey 3000 Series"
         devname "ugen[0-9]+"
         vendor  0x04b9
         product 0x1300
         attach  "/usr/local/etc/rc.d/openct.sh start"
         detach  "/usr/local/etc/rc.d/openct.sh stop"

# The fallthrough entry: Nothing is specified, nothing is done.  And it isn't
# necessary at all :-) .  Just for pretty printing in debugging mode.
#
device "USB device"
         detach "/usr/local/sbin/openct-control shutdown"

I had to add "detach /usr/local/etc/rc.d/openct.sh stop" in section "USB device" too, else it hasn't any effect. I have to close openct framework before I take out token. Else FreeBSD doesn't detach /dev/ugen0 and writes in logs: usb_detach_wait: ugen0 didn't detach.

And he forwarded a note from Petr Holub for FreeBSD 6.0:

On 6.0-RELEASE:
1) Install from ports
   security/openct
   security/opensc
2) add to /etc/devd.conf:
# USB certificate token
attach 50 {
    match "vendor" "0x04b9";
    match "product" "0x1300";
    action "/usr/local/etc/rc.d/openct.sh start";
};
detach 50 {
    match "vendor" "0x04b9";
    match "product" "0x1300";
    action "/usr/local/etc/rc.d/openct.sh stop";
};
3) /etc/rc.d/devd restart

List of issues for FreeBSD:

OpenBSD

install from ports
cd /usr/ports/security/openct
make install clean
cd /usr/ports/security/opensc
make install clean

Erase and key generation works so far, but OpenSSL does not: the OpenSSL shell exits after the engine load command for some unknown reason. Note you need to specify the engine shared object file as *.so.0.0 (on Linux it is simply *.so).

Also OpenBSD has a hotplugd, but so far it does not support USB devices. So you need to run

openct-control shutdown
openct-control init

every time you add or remove a USB crypto token.

Now OpenBSD Current (2005-07-20) passes all OpenSC regression tests with an Aladdin eToken PRO.

Other tokens however did not work, these problems need to be investigated, as well as how to get it to work without UGEN_DEBUG.

other BSD

OpenCT should work, but this wasn't tested for sometime. Latest OpenCT seems to not find libusb, we are working on it.

Solaris

Latest OpenCT supports Solaris fine and was tested to work.

Sunray

Sunray including client/server architecture was added to OpenCT (in version 0.6.5).