A quick installation guide to openct

To install openct, please do as user,

$ wget http://www.opensc-project.org/files/openct/openct-0.6.7.tar.gz
$ tar xfvz openct-0.6.7.tar.gz
$ cd openct-0.6.7

$ ./configure --prefix=/usr --sysconfdir=/etc

This will install openct in /usr, but put the config file into /etc. The configure out put is quite long, with many tests for software, versions and so on. At the end a summary is printed, it should look like this:

OpenCT has been configured with the following options

User binaries:       ${exec_prefix}/bin
Configuration files: /etc

Host:                i686-pc-linux-gnu
Compiler:            gcc
Compiler flags:      -Wall -g -O2 
Preprocessor flags:  -I${top_builddir}/src/include -I${top_srcdir}/src/include 
Linker flags:        
Libraries:           -lpthread 

PC/SC support:       yes
Libusb used:         yes

To use usb tokens and readers, libusb support is highly recommended. PC/SC support is only useful, if you want to use openct drivers with applications other than opensc, using the pcsc-lite middleware. This author does only use openct with opensc and thus would not need PC/SC support.

$ make
$ su root

and as root

# make install

will install all the files.

At system boot, openct needs to create a status file and start a process for every permanent connected reader. For this you need to install the init script into /etc/init.d/ and create startup and shutdown symlinks.

# cp etc/init-script /etc/init.d/openct
# ln -s ../init.d/openct /etc/rc0.d/K50openct
# ln -s ../init.d/openct /etc/rc1.d/S50openct
# ln -s ../init.d/openct /etc/rc2.d/S50openct
# ln -s ../init.d/openct /etc/rc3.d/S50openct
# ln -s ../init.d/openct /etc/rc4.d/S50openct
# ln -s ../init.d/openct /etc/rc5.d/S50openct
# ln -s ../init.d/openct /etc/rc6.d/K20openct

This init script will create the directory /var/run/openct/ when run. If you want to restrict access to openct, it might be best to edit the init script. We have put the mkdir command in the init script, as some distributions use a tmpfs on /var/run/ and thus all files and directories in it vanish after a reboot.

Openct also supports hotplugging. If properly configured you can simply plugin a usb smart card reader and instantly access it, or remove it. Beware: never remove a smart card reader or usb crypto dongle while someone is using it. Incomplete transactions can leave some smart cards confused up to the point of being unusable. This is rare, but it happends.

On linux there is an old hotplug mechanism called "hotplug" and there is "udev" which is a new mechanism to manage device files in /dev/, but also replaces "hotplug" these days. The following instructions will configure your system fine, no matter which one you are using. See OperatingSystems for more details and information on other operating systems.

# cp etc/hotplug.openct /etc/hotplug/usb/openct
# cp etc/openct.usermap /etc/hotplug/usb/openct.usermap
# cp etc/openct.udev /etc/udev/rules.d/95-openct.rules

Finaly, openct needs a config file to work correctly.

# cp etc/openct.conf /etc/openct.conf

if you have serial readers (or anything else, not hotplugged), edit /etc/openct.conf and configure your reader. Here is an example for a Towitoko reader connected to the first serial port:

        reader towitoko {
               driver = towitoko;
               device = serial:/dev/ttyS0;
        };

Now attach all those serial readers and start openct. Hotplug readers already attached will be found as well, but you can as well attach them later.

# /etc/init.d/openct start

now you can test it as user:

$ openct-tool list
  0 Towitoko Chipdrive Micro
  1 Schlumberger E-Gate

As you can see I have a normal, serial reader (Towitoko Chipdrive Micro) and one usb token. If I remove the usb token, it will no longer be listed. If I add a new token, the new one will show up:

$ openct-tool list
  0 Towitoko Chipdrive Micro
  1 Aladdin eToken PRO

I tested this on systems with several usb ports, too. But this "screen shot" is from a system with only one usb port, my old laptop.

If you have a card in the reader, you can get the answer to reset ("ATR"), which is a byte string containing some parameters, but can be used very well to identify a card. Default is reader 0, add "-r 1" to use reader 1.

$ openct-tool -r 1 atr
Detected Aladdin eToken PRO
Card present, status changed
ATR: 3b e2 00 ff c1 10 31 fe 55 c8 02 9c

and similar commands. openct is ready.