Serial readers should work fine on all operating systems. Usb needs hotplug support, so that you can plugin some new usb device, and if it is a smart card reader, openct needs to be notified. Unfortunatly hotplug on linux is currently moving from hotplug to udev or hald, so we document all three sysstems. Freebsd has usbd and dev, and no idea about all other systems.
Linux should work fine, and is tested all the time. Serial support needs nothing special (only the serial driver for your serial device), but usb support on linux has a few requirements:
usbfs /proc/bus/usb usbfs defaults 0 0
(replace "usbfs" with "usbdevfs" for linux kernel 2.4.* - will work on kernel 2.6.* too)
Unfortunatly the situation is no longer this easy. There are three new trends in linux/hotplug: 1.) replace hotplug shell scripts with udev. 2.) create usb device files in /dev/bus/usb/, obsolete /proc/bus/usb/ 3.) use hal in addition to udev, programs like openct should be called by hal.
The first trend is easy: we added a file "openct.udev" to etc/ in the source. Copy it into /etc/udev/rules/ as "95-openct.rules" and you should be fine. QuickStart has the details about it. Even if your system still uses hotplug this should be ok. Note you also need the files in /etc/hotplug/.
The second trend is ok: we changed openct so it works with either paths to the usb devices.
The third trend is difficult: So far hal has nearly no documentation at all, so we can't use it. Also it seems to have less functionality: while hotplug and udev have a mechanism to match any event against a list of what we are interested in, I have not seen anything like that in hal. So using hal would be very inefficient we guess. Also so far noone told us why we should change a running system. Till we learn more about it, hal remains a mysterious new technology.
Daniel Slezak reports for freebsd 5.4 :
I have sold a part of my problem by usbd in FreeBSD 5.4. I add to /etc/usbd.conf:
## Token Rainbow Technologies iKey 3000 Series device "iKey 3000 Series" devname "ugen[0-9]+" vendor 0x04b9 product 0x1300 attach "/usr/local/etc/rc.d/openct.sh start" detach "/usr/local/etc/rc.d/openct.sh stop" # The fallthrough entry: Nothing is specified, nothing is done. And it isn't # necessary at all :-) . Just for pretty printing in debugging mode. # device "USB device" detach "/usr/local/sbin/openct-control shutdown"
I has to add "detach /usr/local/etc/rc.d/openct.sh stop" in section "USB device" too, else it hasn't any effect. I have to close openct framework before I take out token. Else FreeBSD doesn't detach /dev/ugen0 and writes in logs: usb_detach_wait: ugen0 didn't detach.
And he forwarded a note from Petr Holub for FreeBSD 6.0:
On 6.0-RELEASE: 1) Install from ports security/openct security/opensc 2) add to /etc/devd.conf: # USB certificate token attach 50 { match "vendor" "0x04b9"; match "product" "0x1300"; action "/usr/local/etc/rc.d/openct.sh start"; }; detach 50 { match "vendor" "0x04b9"; match "product" "0x1300"; action "/usr/local/etc/rc.d/openct.sh stop"; }; 3) /etc/rc.d/devd restart
List of issues for FreeBSD:
/usr/sbin/openct-control attach /proc/bus/usb/003/002 usb:973/1which has the device path as parameter and "usb:vendor/product" so openct knows the type (usb) and the information (vendor and product) so it can read the openct.conf, look which driver is used for that, and start an ifdhandler like that:
/usr/sbin/ifdhandler -H egate /proc/bus/usb/003/003i.e. "-H" for hotplug, the driver name, and the device file to use. add -v or -vv or even more for debugging. would be nice if freebsd could do something similar, or let us know how to deal with this best.
install from ports cd /usr/ports/security/openct make install clean cd /usr/ports/security/opensc make install clean
Erase and key generation works so far, but openssl does not: the openssl shell exits after the engine load command for some unknown reason. Note you need to specify the engine shared object file as *.so.0.0 (on linux it is simply *.so).
Also OpenBSD has a hotplugd, but so far it does not support usb devices. So you need to run
openct-control shutdown openct-control init
every time you add or remove a usb crypto token.
Now OpenBSD Current (2005-07-20) passes all OpenSC regression tests with an Aladdin eToken PRO.
Other tokens however did not work, these problems need to be investigated, as well as how to get it to work without UGEN_DEBUG.
OpenCT should work, but this wasn't tested for sometime. Latest OpenCT seems to not find libusb, we are working on it.
Latest OpenCT supports Solaris fine and was tested to work.
Sunray including client/server architecture was recently added to OpenCT and 0.6.5 once release should work fine. Till then please use a snapshot or svn trunk checkout.
Some Linux Distributions already include OpenCT and thus you can simply install the packages included with the distribution. Here is an overview:
For GNU/Linux users the best solution is, if the distribution already includes recent packages of OpenSC. Here is a survey of recent distributions. If you have additional infomation, please add it.
Ububuntu / Kubuntu dapper (development) | OpenCT 0.6.6 included in universe |
Ububuntu / Kubuntu 5.10 (breezy, stable) | OpenCT 0.6.5 included in universe |
Debian woody (old stable) | does not contain OpenCT packages |
Debian sarge (stable) | OpenCT 0.6.4 included |
Debian sid (development) | OpenCT 0.6.6 included |
Red Hat Enterprise Linux 4 (and clones) | OpenCT 0.6.2 available at ATrpms |
Red Hat Enterprise Linux 3 (and clones) | OpenCT 0.6.2 avilable at ATrpms |
Fedora Core 3 (Fedora Extras) | OpenCT 0.6.5 included |
Fedora Core 4 (Fedora Extras) | OpenCT 0.6.6 included |
Fedora Core 5 (Fedora Extras) | OpenCT 0.6.6 included |
Gentoo Portage | OpenCT 0.6.5 in dev-libs/openct |
Mandrake | OpenCT 0.1.0 in contrib |
Novell/SUSE LINUX Enterprise Server 9 for x86 | OpenCT 0.1.0 included |
OpenPKG | not included |
Rock Linux | OpenCT 0.6.2 included |
Opensuse development | OpenCT 0.6.5 |
Opensuse 10.0 | OpenCT 0.6.5 included |
Suse 9.3 | OpenCT 0.6.2 included |
Suse 9.2 | OpenCT 0.5.0 included |
Suse 9.1 | OpenCT 0.1.0 included |
ATrpms lists some RPM based distributions (Fedora Core, Red Hat Enterprise Linux and Red Hat Linux).
Other operating systems:
NetBSD | included in pkgsrc-wip for testing |
FreeBSD | 0.6.6 part of port collection |
OpenBSD | part of port collection |
fink / Mac OS X | not included |
DragonFlyBSD | included in pkgsrc-wip for testing |