Libchipcard2 has some advantages over existing card reader ressource managers:
Libchipcard2 autodetects and automatically configures readers at the following buses:
If LibUSB is available at compile time it will be used to scan the USB bus for new devices. Fortunately LibUSB is ported to the major *nix-alike systems ;-) If LibUSB is missing autoconfiguration of USB devices is not possible.
For devices which use a /dev/ttyUSBx device the procfs file "/proc/tty/driver/usb-serial" or "/proc/tty/driver/usbserial" is used. However, revent kernels (2.6.x) only allow root to view these files, so for these systems LibSysFS (part of sysfsutils) is needed.
If OpenSC is installed then the OpenSC-driver for Libchipcard2 is built and installed. This driver allows OpenSC to use Libchipcard.
If the kernel sources are installed at compile time then the PCMCIA scanner code is built. This allows to detect PCMCIA-based card readers.
This file contains a description of which drivers to load and a list of configured readers.
You can copy one of the example files installed to "$PREFIX/etc/chipcard2-server/". For USB-only readers the minimal example can be used. For serial devices the file "chipcardd2.conf.example" can be used as a starting point.
a) local This mode uses Unix Domain Sockets. These sockets are only available on POSIX systems (not on WIN32 platforms), they can only be connected to from the very same machine. This is the recommended mode for local-only usage.
b) public This mode uses simple TCP sockets for IPC. You should not use this mode since it does not provide any encryption.
c) private This mode uses SSL secured sockets. This is the recommended mode on systems where there are no Unix Domain Sockets (i.e. the "local" mode is not available).
d) secure This mode is the same as "private", but it requires the client to present a valid certificate. This certificate is looked up in a directory on the server and if not found access will be denied. You can use this mode if you want to be very safe. It also allows the server to distinguish between multiple users accessing the server, so that administration accounts can be realized (which will only allow special users to execute administrative commands).
For security modes "private" and "secure" some additional setup is to be done. You can do most of that additional setup with the following command:
#>chipcardd2 init
This will create all files necessary for "private" or "secure" mode (such as Diffie-Hellman-parameters, a self-signed certificate etc).
You have to create the server configuration file first (e.g. by just copying one of the example files provided by this package).
Please refer to the file doc/CERTIFICATES for details.
#>chipcardd2 addreader --rname ARG --dtype ARG --rtype ARG --rport ARG
Adds a reader to the configuration. Please see "chipcardd2 --help".
However, in most cases the following does suffice:
#>chipcardd2 --pidfile PIDFILENAME
where PIDFILENAME is the name of the PID file (used to store the process id of the server which can be used to send signals to it).
For debugging purposes the following is more usefull:
#>chipcardd2 --pidfile PIDFILENAME -f --logtype console --loglevel notice
For "loglevel" you can use "--loglevel info" to increase the verbosity even more. The option "-f" makes the daemon stay in the foreground. In this case you can stop it using CTRL-C.
Please note that the server doesn't start if there is no line in the configuration file saying "enabled=1".
This file contains a description of the chipcard2 servers to connect to.
For this to work you need to enable remote drivers in the server configuration file ($PREFIX/etc/chipcard2-server/chipcardd2.conf).
Also, you will have to add a "server" section in the server configuration file which is not "local" (because otherwise the remote driver could not connect to the server).
The next step is to create a configuration file on the thin client which is used by the remote driver daemon $PREFIX/etc/chipcard2-server/chipcardrd.conf
An example file is provided. The driver sections in such a file are nearly the same as in the server configuration file.
reader_driver chipcard2 {
module = /usr/lib/reader-libchipcard2;
}
Such a section allows OpenSC to dynamically load the driver module.
./configure --prefix=/sw LDFLAGS=-L/sw/lib CFLAGS=-I/sw/include CPPFLAGS=-I/sw/include make sudo make install
The configuration files are then expected in /sw/chipcard2-server.
./configure (all in one line) --disable-pcsclite --enable-usbdropdir=/usr/lib/chipcard2-server/lowlevel/ifd --enable-ccidtwindir=/usr/lib/chipcard2-server/lowlevel/ifd make make install
This allows parallel installation of the non-PCSC version of the driver and the PCSC version. Libchipcard2 always searches for the CCID driver in its own lowlevel/ifd folder.
Please note that recent versions of this driver need libpcsclite installed at build-time, but not at runtime. So please do this:
However, the new modular design of the server made it necessary to change the structure of the configuration file a little.
The current version of Libchipcard2 should be able to read existing files, but new files should be created according to the new format (see example files in doc/). Existing files should be modified.
The changes are really minor:
The new structure of the configuration file is this:
Server {
# server settings, haven't changed since previous versions, neither in
# location nor in content
}
DeviceManager {
# This is a new section, it contains the drivers which have been at the
# topmost level of the configuration file in previous versions.
Driver {
# Driver section, the content itself is unchanged
Reader {
# The driver section contains a single change, which doesn't pose much
# of a problem since a driver and reader section was mostly used with
# serial devices.
# The variable "com" (or sometimes "comType") was replaced by the
# variable "busType" (this is due to the internal reorganization).
# The following table shows how to convert existing settings:
#
# Previously (com="") I New (busType="")
# ---------------------+--------------------
# com="serial" I busType="serial"
# com="usb" I busType="UsbRaw"
# com="usbserial" I busType="UsbTty"
# --- I busType="Pci"
# --- I busType="Pcmcia"
# -------------------------------------------
# This allowed me to implement additional bus types (like PCMCIA).
} # Reader
} # Driver
} # DeviceManager
CardManager {
# This is a new optional section which contains some card-related
# settings (see example in doc/)
} # CardManager
ServiceManager {
# This section now contains the "Service" sections which were found in the
# topmost level in previous files.
Service {
# This is a service section as in previous versions. The only change is
# that this section is now below "ServiceManager".
} # Service
}
1.5.3