pam_pkcs11 fails to login with cert on eToken 64

Hi there,

I'm trying to use an eToken Pro 64k with pam_pkcs11 module.
I currently test
the Aladdin (binary) driver. I've put a certificate on the
token, then try to
use it to login to a workstation.

The workstation is running Debian sid, nsswitch uses ldap to
get users
attributes, and I can login using su - <uid>. 

I'm trying to use pwent or ldap mapping, but both fail,
wether I use a login
name or not.

Using pwent mapping:
--------------------

pklogin_finder finds the correct uid.

login using no username finds a match to my uid. Few output
lines from
debugging output returns:

DEBUG:pam_pkcs11.c:465: certificate is valid and matches
user '<uid>'
DEBUG:pkcs11_lib.c:1384: reading 128 random bytes from
/dev/urandom
DEBUG:pkcs11_lib.c:1403: random-value[128] =
[59:43:aa...:95]
DEBUG:pkcs11_lib.c:1345: hash[35] = [...:44:05:df:...:67]
DEBUG:pkcs11_lib.c:1366: increased signature buffer-length
to 512
ERROR:pam_pkcs11.c:531: sign_value() failed: C_Sign()
failed: 91
DEBUG:mapper_mgr.c:214: unloading mapper module list
DEBUG:mapper_mgr.c:137: calling mapper_module_end() pwent
DEBUG:mapper_mgr.c:148: Module pwent is static: don't
remove
DEBUG:pkcs11_lib.c:1065: logout user
DEBUG:pkcs11_lib.c:1071: closing the PKCS #11 session
DEBUG:pkcs11_lib.c:1077: releasing keys and certificates

I dont really get the error, and google search isn't really
useful. I don't
know what's this 91 error code.

If I provide the username 'uid', same thing happens.

Using ldap mapping:
-------------------

pklogin_finder segfaults

End of debug log shows:

DEBUG:ldap_mapper.c:892: Trying to match certificate with
user: '<uid>'
DEBUG:ldap_mapper.c:615: ldap_get_certificate(): begin login
= <uid>
DEBUG:ldap_mapper.c:620: ldap_get_certificate(): filter_str
=
(&(objectClass=posixAccount)(uid=<uid>))
DEBUG:ldap_mapper.c:578: added URI ldap://ldap:389
DEBUG:ldap_mapper.c:679: ldap_get_certificate(): try do_open
for
ldap://ldap:389
DEBUG:ldap_mapper.c:141: do_init():
DEBUG:ldap_mapper.c:411: Set connection timeout to 8
DEBUG:ldap_mapper.c:319: do_bind(): bind DN=""
pass=""
DEBUG:ldap_mapper.c:352: do_bind rc=97
DEBUG:ldap_mapper.c:718: ldap_get_certificate(): entries =
1
DEBUG:ldap_mapper.c:743: attribute name = userCertificate
DEBUG:ldap_mapper.c:748: number auf usercertificates = 1
DEBUG:ldap_mapper.c:766: d2i_X509(): success for certificate
0
DEBUG:ldap_mapper.c:780: ldap_get_certificate(): end
Segmentation fault

Backtrace log is:

#0  0xb7e7257d in X509_check_purpose ()
from /usr/lib/i686/cmov/libcrypto.so.0.9.8
No symbol table info available.
#1  0xb7e5ee46 in X509_cmp () from
/usr/lib/i686/cmov/libcrypto.so.0.9.8
No symbol table info available.
#2  0xb6f5477a in ?? () from /lib/pam_pkcs11/ldap_mapper.so
No symbol table info available.
#3  0x0807fad0 in ?? ()
No symbol table info available.
#4  0x00000000 in ?? ()
No symbol table info available.
The program is running.  Exit anyway? (y or n) 

Not really useful, I know. I may try to rebuild using debug
symbols, but I
currently don't have practical way to do that on this box.

login with username ends with the same log, then returns
back to login prompt
(so I guess it segfaults too)

login without username first search for the right username
(parsing pwent
entries I guess), then returns to prompt. Segfaults too, I
guess.

If I need to provide you some more info, please ask.

Hope you can help, and thanks for your time,
-- 
Yves-Alexis
_______________________________________________
opensc-user mailing list
opensc-userlists.opensc-project.org
http://www.opensc-project.org/mailman/listinfo/opensc-
user

pam_pkcs11 fails to login with cert on eToken 64

Thread: pam_pkcs11 fails to login with cert on eToken 64