Operating Systems: General Notes

Serial readers should work fine on all operating systems. Usb needs hotplug support, so that you can plugin some new usb device, and if it is a smart card reader, openct needs to be notified. Unfortunatly hotplug on linux is currently moving from hotplug to udev or hald, so we document all three sysstems. Freebsd has usbd and dev, and no idea about all other systems.

Linux

Linux should work fine, and is tested all the time. Serial support needs nothing special (only the serial driver for your serial device), but usb support on linux has a few requirements:

(replace "usbfs" with "usbdevfs" for linux kernel 2.4.* - will work on kernel 2.6.* too)

Unfortunatly the situation is no longer this easy. There are three new trends in linux/hotplug: 1.) replace hotplug shell scripts with udev. 2.) create usb device files in /dev/bus/usb/, obsolete /proc/bus/usb/ 3.) use hal in addition to udev, programs like openct should be called by hal.

The first trend is easy: we added a file "openct.udev" to etc/ in the source. Copy it into /etc/udev/rules/ as "95-openct.rules" and you should be fine. QuickStart has the details about it. Even if your system still uses hotplug this should be ok. Note you also need the files in /etc/hotplug/.

The second trend is ok: we changed openct so it works with either paths to the usb devices.

The third trend is difficult: So far hal has nearly no documentation at all, so we can't use it. Also it seems to have less functionality: while hotplug and udev have a mechanism to match any event against a list of what we are interested in, I have not seen anything like that in hal. So using hal would be very inefficient we guess. Also so far noone told us why we should change a running system. Till we learn more about it, hal remains a mysterious new technology.

FreeBSD

Daniel Slezak reports for freebsd 5.4 :

I have sold a part of my problem by usbd in FreeBSD 5.4. I add to /etc/usbd.conf:

## Token Rainbow Technologies iKey 3000 Series
device "iKey 3000 Series"
         devname "ugen[0-9]+"
         vendor  0x04b9
         product 0x1300
         attach  "/usr/local/etc/rc.d/openct.sh start"
         detach  "/usr/local/etc/rc.d/openct.sh stop"

# The fallthrough entry: Nothing is specified, nothing is done.  And it isn't
# necessary at all :-) .  Just for pretty printing in debugging mode.
#
device "USB device"
         detach "/usr/local/sbin/openct-control shutdown"

I has to add "detach /usr/local/etc/rc.d/openct.sh stop" in section "USB device" too, else it hasn't any effect. I have to close openct framework before I take out token. Else FreeBSD doesn't detach /dev/ugen0 and writes in logs: usb_detach_wait: ugen0 didn't detach.

And he forwarded a note from Petr Holub for FreeBSD 6.0:

On 6.0-RELEASE:
1) Install from ports
   security/openct
   security/opensc
2) add to /etc/devd.conf:
# USB certificate token
attach 50 {
    match "vendor" "0x04b9";
    match "product" "0x1300";
    action "/usr/local/etc/rc.d/openct.sh start";
};
detach 50 {
    match "vendor" "0x04b9";
    match "product" "0x1300";
    action "/usr/local/etc/rc.d/openct.sh stop";
};
3) /etc/rc.d/devd restart

List of issues for FreeBSD:

OpenBSD

install from ports
cd /usr/ports/security/openct
make install clean
cd /usr/ports/security/opensc
make install clean

Erase and key generation works so far, but openssl does not: the openssl shell exits after the engine load command for some unknown reason. Note you need to specify the engine shared object file as *.so.0.0 (on linux it is simply *.so).

Also OpenBSD has a hotplugd, but so far it does not support usb devices. So you need to run

openct-control shutdown
openct-control init

every time you add or remove a usb crypto token.

Now OpenBSD Current (2005-07-20) passes all OpenSC regression tests with an Aladdin eToken PRO.

Other tokens however did not work, these problems need to be investigated, as well as how to get it to work without UGEN_DEBUG.

other BSD

OpenCT should work, but this wasn't tested for sometime. Latest OpenCT seems to not find libusb, we are working on it.

Solaris

Latest OpenCT supports Solaris fine and was tested to work.

Sunray

Sunray including client/server architecture was recently added to OpenCT and 0.6.5 once release should work fine. Till then please use a snapshot or svn trunk checkout.

Operating Systems: Already included

Some Linux Distributions already include OpenCT and thus you can simply install the packages included with the distribution. Here is an overview:

Linux Distributions

For GNU/Linux users the best solution is, if the distribution already includes recent packages of OpenSC. Here is a survey of recent distributions. If you have additional information, please add it.

Ububuntu 6.10 (edgy) OpenCT 0.6.8 included in universe
Ububuntu 6.06 (dapper) OpenCT 0.6.6 included in universe
Ububuntu 5.10 (breezy) OpenCT 0.6.5 included in universe
Debian woody (old stable) does not contain OpenCT packages
Debian sarge (stable) OpenCT 0.6.4 included
Debian sid (development) OpenCT 0.6.6 included
Red Hat Enterprise Linux 4 (and clones) OpenCT 0.6.2 available at ATrpms
Red Hat Enterprise Linux 3 (and clones) OpenCT 0.6.2 available at ATrpms
Fedora Core 6 (Fedora Extras) OpenCT 0.6.10 included
Fedora Core 5 (Fedora Extras) OpenCT 0.6.9 included
Fedora Core 4 (Fedora Extras) OpenCT 0.6.6 included
Fedora Core 3 (Fedora Extras) OpenCT 0.6.5 included
Gentoo Portage OpenCT 0.6.5 in dev-libs/openct
Mandrake OpenCT 0.1.0 in contrib
Novell/SUSE LINUX Enterprise Server 9 for x86 OpenCT 0.1.0 included
OpenPKG not included
Rock Linux OpenCT 0.6.2 included
Opensuse development OpenCT 0.6.5
Opensuse 10.0 OpenCT 0.6.5 included
Suse 9.3 OpenCT 0.6.2 included
Suse 9.2 OpenCT 0.5.0 included
Suse 9.1 OpenCT 0.1.0 included

ATrpms lists some RPM based distributions (Fedora Core, Red Hat Enterprise Linux and Red Hat Linux).

Other operating systems:

NetBSD included in pkgsrc-wip for testing
FreeBSD 0.6.6 part of port collection
OpenBSD part of port collection
fink / Mac OS X not included
DragonFlyBSD included in pkgsrc-wip for testing