Re: [opensc-devel] pam_pkcs11 with many certificates on a single token

2012-12-12 Thread Ludovic Rousseau
2012/12/10 : > Hello, > > Here is my patch (actually, 2 patches that depend if the patch concerns only > the error 2328 (patch 1) or the whole block processing the return value of > verify_certificate() (patch 2)). Patch 2 applied in git https://github.com/OpenSC/pam_pkcs11/commit/75613e32dfc49

Re: [opensc-devel] pam_pkcs11 with many certificates on a single token

2012-12-10 Thread Peter Stuge
frederic.comb...@cea.fr wrote: > Here is my patch (actually, 2 patches that depend if the patch > concerns only the error 2328 (patch 1) or the whole block > processing the return value of verify_certificate() (patch 2)). Patch 1 is obviously incorrect because your change is inside a conditional.

Re: [opensc-devel] pam_pkcs11 with many certificates on a single token

2012-12-10 Thread frederic.combeau
d'origine- De : Ludovic Rousseau [mailto:ludovic.rouss...@gmail.com] Envoyé : lundi 10 décembre 2012 13:49 À : COMBEAU Frederic 150138 Cc : opensc-devel@lists.opensc-project.org Objet : Re: [opensc-devel] pam_pkcs11 with many certificates on a single token 2012/12/10 : > Hello, Hel

Re: [opensc-devel] pam_pkcs11 with many certificates on a single token

2012-12-10 Thread Ludovic Rousseau
2012/12/10 : > Hello, Hello, > I use pam_pkcs11 0.6.8 with libcurl but without nss. My tokens works fine but > they can contain 4 or 5 certificates (with corresponding rsa keys). > > My certificates are not all from the same PKI, so they are not certified by > the same ACs. > > The problem I e

[opensc-devel] pam_pkcs11 with many certificates on a single token

2012-12-10 Thread frederic.combeau
Hello, I use pam_pkcs11 0.6.8 with libcurl but without nss. My tokens works fine but they can contain 4 or 5 certificates (with corresponding rsa keys). My certificates are not all from the same PKI, so they are not certified by the same ACs. The problem I encounter with pam_pkcs11 is that if

Re: [opensc-devel] [pam_pkcs11] improved error messages

2011-03-22 Thread Ludovic Rousseau
2011/3/21 Dominik Fischer : > > > Anfang der weitergeleiteten E-Mail: > >> Von: "Dominik Fischer" >> Datum: 21. März 2011 15:43:02 MEZ >> An: "Ludovic Rousseau" >> Betreff: Re: [opensc-devel] [pam_pkcs11] improved error messages >> &

[opensc-devel] [pam_pkcs11] improved error messages

2011-03-21 Thread Dominik Fischer
Anfang der weitergeleiteten E-Mail: > Von: "Dominik Fischer" > Datum: 21. März 2011 15:43:02 MEZ > An: "Ludovic Rousseau" > Betreff: Re: [opensc-devel] [pam_pkcs11] improved error messages > > >>>>> (I'm not sure if the mailing

Re: [opensc-devel] [pam_pkcs11] improved error messages

2011-03-21 Thread Martin Paljak
Hello, Mailing list should eat attachments just fine (50KB limit IIRC) On Mar 20, 2011, at 8:00 PM, Dominik Fischer wrote: > It adds displaying error messages to the user via pam_prompt. Because in > GDM the messages disappear so quick, I've added a new option > "err_display_time". After > a mes

Re: [opensc-devel] [pam_pkcs11] improved error messages

2011-03-21 Thread Ludovic Rousseau
2011/3/20 Dominik Fischer : > Hello Ludovic, > > here my next patch (this time a big one). > > It adds displaying error messages to the user via pam_prompt. Because in > GDM the messages disappear so quick, I've added a new option > "err_display_time". After > a message is shown with pam_prompt, a

[opensc-devel] [pam_pkcs11] improved error messages

2011-03-20 Thread Dominik Fischer
Hello Ludovic, here my next patch (this time a big one). It adds displaying error messages to the user via pam_prompt. Because in GDM the messages disappear so quick, I've added a new option "err_display_time". After a message is shown with pam_prompt, a "sleep(err_display_time)" is called. This

Re: [opensc-devel] [pam_pkcs11] pwent_mapper_find_user

2011-03-20 Thread Ludovic Rousseau
2011/3/20 Dominik Fischer : > Hi Ludovic, > > sorry to bother you again... I've forgotten one line in my patch :-/ > Could you please also add the included patch? Done in revision 490. > Just to let you know: I've another patch pending. This will add > more error messages presented to  the users.

Re: [opensc-devel] [pam_pkcs11] pwent_mapper_find_user

2011-03-20 Thread Dominik Fischer
Hi Ludovic, sorry to bother you again... I've forgotten one line in my patch :-/ Could you please also add the included patch? Just to let you know: I've another patch pending. This will add more error messages presented to the users. We have this working for a long time and it really improved

Re: [opensc-devel] [pam_pkcs11] pwent_mapper_find_user

2011-03-20 Thread Ludovic Rousseau
2011/3/19 Dominik Fischer : > Hello! > > pwent_mapper_find_user() searches through all available passwd db entries to > find an user. > This takes a very long time, if you have many users (1). Additionally, if > you have nss-ldap > configured, it transfers a large amount of data (which is exp

[opensc-devel] [pam_pkcs11] pwent_mapper_find_user

2011-03-19 Thread Dominik Fischer
Hello! pwent_mapper_find_user() searches through all available passwd db entries to find an user. This takes a very long time, if you have many users (1). Additionally, if you have nss-ldap configured, it transfers a large amount of data (which is expensive on mobile connections...). Incl

Re: [opensc-devel] pam_pkcs11

2010-10-25 Thread Andre Zepezauer
Hello Ludovic, On Tue, 2010-10-19 at 16:53 +0200, Ludovic Rousseau wrote: > 2010/10/19 Andre Zepezauer : > > Hello Ludovic, > > > > currently the mapper modules are unloaded only on authentication > > failure. This patch let them unload on success too. > > Fixed in revision 465. > > Andre, do yo

Re: [opensc-devel] pam_pkcs11

2010-10-19 Thread Ludovic Rousseau
2010/10/19 Andre Zepezauer : > Hello Ludovic, > > currently the mapper modules are unloaded only on authentication > failure. This patch let them unload on success too. Fixed in revision 465. Andre, do you want to have a write access to the pam_pkcs11 repository, and commit fixes directly? Bye

[opensc-devel] pam_pkcs11

2010-10-19 Thread Andre Zepezauer
Hello Ludovic, currently the mapper modules are unloaded only on authentication failure. This patch let them unload on success too. Regards Andre Index: pam_pkcs11/pam_pkcs11.c === --- pam_pkcs11/pam_pkcs11.c (revision 464) +++

Re: [opensc-devel] pam_pkcs11

2010-10-19 Thread Ludovic Rousseau
2010/10/19 Andre Zepezauer : > Hello Ludovic, > > the attached patch prevents the access of unallocated memory in > pam_pkcs11. This happens while performing on-line certificate > verification. The case where crl:s are fetched via http-request. Two > additional fixes are included. Changes in detail

[opensc-devel] pam_pkcs11

2010-10-18 Thread Andre Zepezauer
Hello Ludovic, the attached patch prevents the access of unallocated memory in pam_pkcs11. This happens while performing on-line certificate verification. The case where crl:s are fetched via http-request. Two additional fixes are included. Changes in detail: * add missing return statement * allo

Re: [opensc-devel] pam_pkcs11 (enable debug)

2010-09-22 Thread Ludovic Rousseau
2010/5/10 Andre Zepezauer : > On Wed, 2010-09-22 at 09:20 +0200, Ludovic Rousseau wrote: >> Why do you check for pin == NULL? >> Is NULL a valid return value for getpass()? Not from my manpage. So >> patch rejected for now. > > Definition from Open Group: > http://opengroup.org/onlinepubs/007908775

Re: [opensc-devel] pam_pkcs11 (enable debug)

2010-09-22 Thread Andre Zepezauer
On Wed, 2010-09-22 at 09:20 +0200, Ludovic Rousseau wrote: > 2010/5/10 Andre Zepezauer : > > There is another issue with the output of debug messages. It is that the > > users pin will be log by default. This can only be disabled at > > compilation time. I assume that there will be always some syst

Re: [opensc-devel] pam_pkcs11 (enable debug)

2010-09-22 Thread Ludovic Rousseau
2010/5/10 Andre Zepezauer : > There is another issue with the output of debug messages. It is that the > users pin will be log by default. This can only be disabled at > compilation time. I assume that there will be always some systems where > debug is enabled. This is not a recommended practise, b

Re: [opensc-devel] pam_pkcs11 (enable debug)

2010-09-21 Thread Andre Zepezauer
Hello Ludovic, > 2010/9/20 Andre Zepezauer : > > Hello, > > > > today I had to configure a host with pam_pkcs11. Doing that, I was > > forced to edit the files in /etc/pam.d/ to get the debug messages of > > pam_pkcs11. The corresponding option in the configuration file doesn't > > have any effect

Re: [opensc-devel] pam_pkcs11 (enable debug)

2010-09-21 Thread Ludovic Rousseau
2010/9/20 Andre Zepezauer : > Hello, > > today I had to configure a host with pam_pkcs11. Doing that, I was > forced to edit the files in /etc/pam.d/ to get the debug messages of > pam_pkcs11. The corresponding option in the configuration file doesn't > have any effects. The attached patch fixes th

[opensc-devel] pam_pkcs11 (enable debug)

2010-09-20 Thread Andre Zepezauer
Hello, today I had to configure a host with pam_pkcs11. Doing that, I was forced to edit the files in /etc/pam.d/ to get the debug messages of pam_pkcs11. The corresponding option in the configuration file doesn't have any effects. The attached patch fixes this unexpected behaviour. Regards Andre

Re: [opensc-devel] pam_pkcs11: Patch for #239 and #240 (handle more than one cert/pattern matching)

2010-08-14 Thread Ludovic Rousseau
2010/6/26 Wolf Geldmacher : > Here's a patch to solve the issues I've encountered using pam_pkcs11. > > In regards to #239 (pam_pkcs11 only looks at first certificate on > token): > > The fix for this turns out to be somewhat problematic, and I'm not at > all sure, whether my implementation of the

Re: [opensc-devel] pam_pkcs11: Patch for #239 and #240 (handle more than one cert/pattern matching)

2010-06-29 Thread Ludovic Rousseau
2010/6/26 Wolf Geldmacher : > Here's a patch to solve the issues I've encountered using pam_pkcs11. Thanks. I do not have the time now to review your patch, not before a few weeks. But I keep your mail on my todo list. Bye -- Dr. Ludovic Rousseau ___

[opensc-devel] pam_pkcs11: Patch for #239 and #240 (handle more than one cert/pattern matching)

2010-06-26 Thread Wolf Geldmacher
Here's a patch to solve the issues I've encountered using pam_pkcs11. In regards to #239 (pam_pkcs11 only looks at first certificate on token): The fix for this turns out to be somewhat problematic, and I'm not at all sure, whether my implementation of the fix is a valid one. The basic problem (

[opensc-devel] pam_pkcs11 release 0.6.2

2009-12-19 Thread Ludovic Rousseau
Hello, I just released a new version of pam_pkcs11. This version includes many fixes I integrated since release 0.6.1. Thanks to all the users for reporting bugs and patches. Complete subversion changelog is: 2009-12-17 ludovic.rousseau * [r390] doc/pkcs11_setup.1: document use_module

Re: [opensc-devel] pam_pkcs11 & CFK_LOGIN_REQUIRED

2009-12-03 Thread Ludovic Rousseau
2009/12/2 Oleg Smirnov : > Hi! > >  pam_pkcs11 doesn't work with cards with no PIN installed. It tries to > C_Login() whenever PIN is really needed and fails with "C_Login() > failed: 0x0102". > >  I've made a patch which corrects this behavior: > >  * implements get_slot_login_required() funct

[opensc-devel] pam_pkcs11 & CFK_LOGIN_REQUIRED

2009-12-02 Thread Oleg Smirnov
Hi! pam_pkcs11 doesn't work with cards with no PIN installed. It tries to C_Login() whenever PIN is really needed and fails with "C_Login() failed: 0x0102". I've made a patch which corrects this behavior: * implements get_slot_login_required() function what checks whether current slot req

Re: [opensc-devel] PAM_PKCS11..

2009-06-12 Thread Ludovic Rousseau
2009/3/17 JonasOholm : > Hi, Hello, > 1) > I've been trying to use > http://www.opensc-project.org/files/pam_pkcs11/snapshots/pam_pkcs11-0.6.0.tar.gz > and also > http://www.opensc-project.org/files/pam_pkcs11/pam_pkcs11-0.6.0.tar.gz > > Is it so that you have to download secutil.h from: > http:/

[opensc-devel] pam_pkcs11 0.6.1 available

2009-06-12 Thread Ludovic Rousseau
Hello, I uploaded pam_pkcs11 [1] version 0.6.1. Available at [2]. This version has many small fixes and improvements. See the ChangeLog.svn file for an exhaustive list. If you find bugs please report them using the bug tracker [3]. [1] https://www.opensc-project.org/pam_pkcs11/wiki [2] http://w

[opensc-devel] PAM_PKCS11..

2009-06-10 Thread JonasOholm
Hi, 1) I've been trying to use http://www.opensc-project.org/files/pam_pkcs11/snapshots/pam_pkcs11-0.6.0.tar.gz and also http://www.opensc-project.org/files/pam_pkcs11/pam_pkcs11-0.6.0.tar.gz Is it so that you have to download secutil.h from: http://www.opensc-project.org/pam_pkcs11/browser/trun

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-11-06 Thread Ludovic Rousseau
On Tue, Nov 4, 2008 at 7:46 PM, Robert Relyea <[EMAIL PROTECTED]> wrote: > Ludovic Rousseau wrote: >> >> On Fri, Oct 31, 2008 at 12:25 AM, Robert Relyea <[EMAIL PROTECTED]> >> wrote: >> >>> >>> Stanislav Brabec wrote: >>> Could it be implemented using CERT_DecodeDERCertificate()? >>>

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-11-04 Thread Robert Relyea
Ludovic Rousseau wrote: On Fri, Oct 31, 2008 at 12:25 AM, Robert Relyea <[EMAIL PROTECTED]> wrote: Stanislav Brabec wrote: Could it be implemented using CERT_DecodeDERCertificate()? extern CERTCertificate * CERT_DecodeDERCertificate (SECItem *derSignedCert, PRBool copyDER, char *nickna

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-11-04 Thread Ludovic Rousseau
On Fri, Oct 31, 2008 at 12:25 AM, Robert Relyea <[EMAIL PROTECTED]> wrote: > Stanislav Brabec wrote: >> Could it be implemented using CERT_DecodeDERCertificate()? >> >> extern CERTCertificate * >> CERT_DecodeDERCertificate (SECItem *derSignedCert, PRBool copyDER, char >> *nickname); >> > > Don't us

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-11-04 Thread Ludovic Rousseau
On Tue, Oct 28, 2008 at 7:23 PM, Robert Relyea <[EMAIL PROTECTED]> wrote: > When identical certs are imported into NSS, they are given the same > reference counted pointer, so the test is as easy as: > cert1 == cert2 Commited in revision 354. Thanks. -- Dr. Ludovic Rousseau ___

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-30 Thread Robert Relyea
Stanislav Brabec wrote: Robert Relyea wrote: When identical certs are imported into NSS, they are given the same reference counted pointer, so the test is as easy as: cert1 == cert2 Thanks, and what about d2i_X509() counterpart: undefined symbol: d2i_X509 (.libs/ldap

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-29 Thread Stanislav Brabec
Robert Relyea wrote: >When identical certs are imported into NSS, they are given the same > reference counted pointer, so the test is as easy as: >cert1 == cert2 Thanks, and what about d2i_X509() counterpart: > > undefined symbol: d2i_X509 (.libs/ldap_mapper.so) > > > > So the libr

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-28 Thread Robert Relyea
Ludovic Rousseau wrote: 2008/10/24 Stanislav Brabec <[EMAIL PROTECTED]>: Ludovic Rousseau wrote: 2008/10/17 Stanislav Brabec <[EMAIL PROTECTED]>: "Fixed" in revision 353. http://www.opensc-project.org/pam_pkcs11/changeset/353 Not yet completely. This seems to be critical

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-28 Thread Ludovic Rousseau
2008/10/24 Stanislav Brabec <[EMAIL PROTECTED]>: > Ludovic Rousseau wrote: >> 2008/10/17 Stanislav Brabec <[EMAIL PROTECTED]>: > >> "Fixed" in revision 353. >> http://www.opensc-project.org/pam_pkcs11/changeset/353 > > Not yet completely. This seems to be critical: Not really critical in fact :-)

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-24 Thread Stanislav Brabec
Ludovic Rousseau wrote: > 2008/10/17 Stanislav Brabec <[EMAIL PROTECTED]>: > "Fixed" in revision 353. > http://www.opensc-project.org/pam_pkcs11/changeset/353 Not yet completely. This seems to be critical: ldap_mapper.c: In function 'ldap_get_certificate': ldap_mapper.c:760: warning: assignment

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-24 Thread Ludovic Rousseau
2008/10/17 Stanislav Brabec <[EMAIL PROTECTED]>: > Stanislav Brabec wrote: >> Ludovic Rousseau wrote: >> > But I have two warnings: >> > ldap_mapper.c:874: warning: passing argument 1 of 'X509_cmp' from >> > incompatible pointer type >> > ldap_mapper.c:874: warning: passing argument 2 of 'X509_cmp'

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-17 Thread Stanislav Brabec
Stanislav Brabec wrote: > Ludovic Rousseau wrote: > > But I have two warnings: > > ldap_mapper.c:874: warning: passing argument 1 of 'X509_cmp' from > > incompatible pointer type > > ldap_mapper.c:874: warning: passing argument 2 of 'X509_cmp' from > > incompatible pointer type > > I spent a quite

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-16 Thread Stanislav Brabec
Ludovic Rousseau wrote: > But I have two warnings: > ldap_mapper.c:874: warning: passing argument 1 of 'X509_cmp' from > incompatible pointer type > ldap_mapper.c:874: warning: passing argument 2 of 'X509_cmp' from > incompatible pointer type I spent a quite a lot of time to identify this problem.

Re: [opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-16 Thread Ludovic Rousseau
2008/10/15 Stanislav Brabec <[EMAIL PROTECTED]>: > Attached two patches fix compilation errors or warnings when compiling > with NSS support. > > Compiler messages are mentioned in patch headers. Corrected in revision 347 and 348. Thanks > Note that implicit declaration fix again refers to implic

[opensc-devel] pam_pkcs11: more implicit and conflicting declaration fixes

2008-10-15 Thread Stanislav Brabec
Attached two patches fix compilation errors or warnings when compiling with NSS support. Compiler messages are mentioned in patch headers. Note that implicit declaration fix again refers to implicit declaration of function 'X509_cmp' problem, which may need x509.h, but location of this header may

Re: [opensc-devel] pam_pkcs11: Patches from openSUSE Build System

2008-09-29 Thread Stanislav Brabec
Ludovic Rousseau wrote: > 2008/9/25 Stanislav Brabec <[EMAIL PROTECTED]>: > > pam_pkcs11-implicit-declaration.patch: Fixes implicit declaration and > > possible crash on 64 bits. More information in the patch header. > > I do not have a ssl/x509.h file on my system. I have openssl/x509.h > and th

Re: [opensc-devel] pam_pkcs11: Patches from openSUSE Build System

2008-09-26 Thread Ludovic Rousseau
2008/9/25 Stanislav Brabec <[EMAIL PROTECTED]>: > Hallo. > > There are several patches from the openSUSE pam_pkcs11 package. > > Feel free to pick them for the upstream package. > > All of them should apply on current trunk: > > pam_pkcs11-implicit-declaration.patch: Fixes implicit declaration and

[opensc-devel] pam_pkcs11: Patches from openSUSE Build System

2008-09-25 Thread Stanislav Brabec
Hallo. There are several patches from the openSUSE pam_pkcs11 package. Feel free to pick them for the upstream package. All of them should apply on current trunk: pam_pkcs11-implicit-declaration.patch: Fixes implicit declaration and possible crash on 64 bits. More information in the patch heade

Re: [opensc-devel] pam_pkcs11 event manager sample configuration

2008-06-20 Thread Ludovic Rousseau
Hello Michael, On Thu, Jun 19, 2008 at 5:08 PM, Juan Antonio Martinez <[EMAIL PROTECTED]> wrote: > El mié, 18-06-2008 a las 23:29 +0200, Michael Grünewald escribió: >> Hello, >> during work for a seminar about smartcards and linux I found pam_pkcs11, >> which works really nice. But I think there i

Re: [opensc-devel] pam_pkcs11 event manager sample configuration

2008-06-19 Thread Juan Antonio Martinez
El mié, 18-06-2008 a las 23:29 +0200, Michael Grünewald escribió: > Hello, > during work for a seminar about smartcards and linux I found pam_pkcs11, > which works really nice. But I think there is a major security issue in the > card_eventmgr/pkcs11_cardmgr configuration samples. The screensaver

Re: [opensc-devel] pam_pkcs11 broken

2008-02-25 Thread Andreas Jellinghaus
Am Montag, 25. Februar 2008 11:28:21 schrieb Ludovic Rousseau: > I added the missing files (I guess) > > I can now do: > $ svn co trunk > $ cd trunk > $ ./bootstrap > $ ./configure > $ make distcheck ok, thanks a lot! will see if tonight snapshot cron job now works. good night, Andreas _

Re: [opensc-devel] pam_pkcs11 broken

2008-02-25 Thread Ludovic Rousseau
On Sat, Feb 23, 2008 at 1:39 PM, Andreas Jellinghaus <[EMAIL PROTECTED]> wrote: > Am Freitag, 22. Februar 2008 15:36:05 schrieb Ludovic Rousseau: > > > I have no real objection to add po/Makefile.in.in anc config.rpath > > (and others) in SVN. They both are installed by running gettextize. > > Th

Re: [opensc-devel] pam_pkcs11 broken

2008-02-23 Thread Andreas Jellinghaus
Am Freitag, 22. Februar 2008 15:36:05 schrieb Ludovic Rousseau: > I have no real objection to add po/Makefile.in.in anc config.rpath > (and others) in SVN. They both are installed by running gettextize. > They can be updated if needed. can you do so? at least my versions of the tools didn't create

Re: [opensc-devel] pam_pkcs11 broken

2008-02-22 Thread Ludovic Rousseau
On Fri, Feb 22, 2008 at 11:30 AM, Andreas Jellinghaus <[EMAIL PROTECTED]> wrote: > po/Makefile.in.in is missing from svn. > > any reason not to add it? Because it is (re)created by gettextize? > I can generate it with gettextize, but that changes lots of other stuff as > well, so I don't think

Re: [opensc-devel] pam_pkcs11 broken

2008-02-22 Thread Andreas Jellinghaus
also Makefile.am mentions config.rpath - which is not available on my system or not installed (guess it can be deleted). after "make maintainer-clean" I noticed a number of files still there - "svn log" doesn't show them because of svn:ignore property, but a diff with an untouched checkout shows

[opensc-devel] pam_pkcs11 broken

2008-02-22 Thread Andreas Jellinghaus
po/Makefile.in.in is missing from svn. any reason not to add it? I can generate it with gettextize, but that changes lots of other stuff as well, so I don't think we want that command in bootstrap script. I guess the svn ignore on "*.in" cought it and thus it was only forgotten by accident, but

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-18 Thread Ludovic Rousseau
On 18/06/07, Douglas E. Engert <[EMAIL PROTECTED]> wrote: > Sounds like you should have two version, an OpenSSL based version, > and an NSS based version at least until the issues are addressed. > > Not only will the pam_pkcs11 be calling NSS or OpenSSL, other pam modules in > the pam stack or even

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-18 Thread Douglas E. Engert
Sounds like you should have two version, an OpenSSL based version, and an NSS based version at least until the issues are addressed. Not only will the pam_pkcs11 be calling NSS or OpenSSL, other pam modules in the pam stack or even the application may be using OpenSSL. For example, one may want t

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-15 Thread Alon Bar-Lev
Robert, I don't want to offend anyone, but I think that now pam_pkcs11 is a big mess. Some of the features are available when nss is used and some are not. Some parameters are taken from extenal nss configuration some from pam_pkcs11 configuration. You need to manage the module in two different wa

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-15 Thread Robert Relyea
Alon Bar-Lev wrote: > 2. I've look at the code. It seems like you added the whole nss into > the source... I don't understand why... You can use the external > library files. > No, I definately did not add all of NSS, it used NSS from a shared library. I'm not sure what code you think is NSS. Wha

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-15 Thread Alon Bar-Lev
On 6/16/07, Robert Relyea <[EMAIL PROTECTED]> wrote: > > 1. The new version prompt some annoying messages in X... This is > > related to the new pam_prompt addition when HAVE_SECURITY_PAM_EXT_H is > > defined. > pam_prompt should not be blocking, pam_prompt only displays information. > If it's bloc

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-15 Thread Robert Relyea
Alon Bar-Lev wrote: Hello Ludovic, 1. The new version prompt some annoying messages in X... This is related to the new pam_prompt addition when HAVE_SECURITY_PAM_EXT_H is defined. pam_prompt should not be blocking, pam_prompt only displays information. If it's blocking, then there is somethi

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-15 Thread Alon Bar-Lev
Hello Ludovic, 1. The new version prompt some annoying messages in X... This is related to the new pam_prompt addition when HAVE_SECURITY_PAM_EXT_H is defined. 2. I've look at the code. It seems like you added the whole nss into the source... I don't understand why... You can use the external lib

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-14 Thread Alon Bar-Lev
Hello Ludovic, Something is different with this version. When I unlock xsession I see messages like: Please insert smart card or enter user name Must press Smart card inserted Must press Welcome Must press This is very annoying... What was changed? On 6/11/07, Ludovic Rousseau <[EMAIL PROTEC

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-12 Thread Ludovic Rousseau
On 11/06/07, Alon Bar-Lev <[EMAIL PROTECTED]> wrote: > BTW: We can shrink up the code if next version will use pkcs11-helper :) Please, send a patch. I just hope it will not collide with the NSS support. I imagine NSS and pkcs11-helper are orthogonal features, aren't they? bye -- Dr. Ludovic

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-11 Thread Alon Bar-Lev
Thanks! NSS seems to be overkill for most requirements... But I understand the maintenance argument, but I don't think maintaining NSS is simpler thank OpenSSL... :) BTW: Slotevents and multi provider is offered by pkcs11-helper as well, so solution may be much simpler :) Best Regards, Alon Bar-

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-11 Thread Robert Relyea
Alon Bar-Lev wrote: On 6/11/07, Ludovic Rousseau <[EMAIL PROTECTED]> wrote: This new version contains the patches from RedHat to use NSS instead of OpenSSL and many other improvements they made. See the ChangeLog.svn file for an exhaustive list. Hi! Great! I am curios, why did you swi

Re: [opensc-devel] pam_pkcs11 0.6.0 available

2007-06-11 Thread Alon Bar-Lev
On 6/11/07, Ludovic Rousseau <[EMAIL PROTECTED]> wrote: > This new version contains the patches from RedHat to use NSS instead > of OpenSSL and many other improvements they made. See the > ChangeLog.svn file for an exhaustive list. Hi! Great! I am curios, why did you switch to NSS? BTW: We can s

[opensc-devel] pam_pkcs11 0.6.0 available

2007-06-11 Thread Ludovic Rousseau
Hello, After more than a year without a new version I uploaded pam_pkcs11 [1] version 0.6.0. Available at [2]. This new version contains the patches from RedHat to use NSS instead of OpenSSL and many other improvements they made. See the ChangeLog.svn file for an exhaustive list. pam_pkcs11 can

Re: [opensc-devel] pam_pkcs11 LDAP mapping modules

2007-05-23 Thread Ludovic Rousseau
On 23/05/07, Lane, Ryan <[EMAIL PROTECTED]> wrote: > First off, I've created a new LDAP mapping module for using the CN > attribute. Where do I send the code? Just here on this list. > Second, the code I'm sending in may need to be cleaned up some. I'm not > usually a C programmer, so there are l

[opensc-devel] pam_pkcs11 LDAP mapping modules

2007-05-23 Thread Lane, Ryan
Hi all. I'm new to this list, so I apologize in advance if I ask any noobish questions. First off, I've created a new LDAP mapping module for using the CN attribute. Where do I send the code? Second, the code I'm sending in may need to be cleaned up some. I'm not usually a C programmer, so

Re: [opensc-devel] pam_pkcs11 NSS patch.

2007-05-21 Thread Ludovic Rousseau
On 21/05/07, Robert Relyea <[EMAIL PROTECTED]> wrote: > It looks like an added file didn't get put in the repository: > src/tools/pkcs11_setup.c Argh. Exact. Commited in revision 273. > I'll get the 3 patch ready shortly. OK. Thanks -- Dr. Ludovic Rousseau

Re: [opensc-devel] pam_pkcs11 NSS patch.

2007-05-21 Thread Robert Relyea
Ludovic Rousseau wrote: >> > I can >> > supply a patch that will also work with older versions of pam, and use >> > configure to determine which you have. >> >> That would be great. Otherwise pam_pkcs11 could not be complied on >> Debian (and derivatives) without hacking. > > Any progress on t

Re: [opensc-devel] pam_pkcs11 NSS patch.

2007-05-21 Thread Ludovic Rousseau
On 16/05/07, Robert Relyea <[EMAIL PROTECTED]> wrote: > Ludovic Rousseau wrote: > > On 09/05/07, Ludovic Rousseau <[EMAIL PROTECTED]> wrote: > >> On 09/05/07, Robert Relyea <[EMAIL PROTECTED]> wrote: > >> > Ludovic Rousseau wrote: > >> > > On 13/04/07, Robert Relyea <[EMAIL PROTECTED]> wrote: > >>

Re: [opensc-devel] pam_pkcs11 NSS patch.

2007-05-09 Thread Ludovic Rousseau
On 09/05/07, Robert Relyea <[EMAIL PROTECTED]> wrote: > Ludovic Rousseau wrote: > > On 13/04/07, Robert Relyea <[EMAIL PROTECTED]> wrote: > > I can't find the needed file security/pam_ext.h in your patch. I guess > > you forgot to add --new-file when you used diff :-) > > > > Can you send the missi

Re: [opensc-devel] pam_pkcs11 NSS patch.

2007-05-09 Thread Robert Relyea
Ludovic Rousseau wrote: On 13/04/07, Robert Relyea <[EMAIL PROTECTED]> wrote: Here's patch installment 2 of 3. I can't find the needed file security/pam_ext.h in your patch. I guess you forgot to add --new-file when you used diff :-) Can you send the missing file? It's part of pam 0.99.6.2 (s

Re: [opensc-devel] pam_pkcs11 LDAP patch Was: Re: pam_pkcs11 NSS patch.

2007-05-09 Thread Ludovic Rousseau
On 20/04/07, S. Wefel <[EMAIL PROTECTED]> wrote: > Ludovic Rousseau schrieb: > > On 04/04/07, Ludovic Rousseau <[EMAIL PROTECTED]> wrote: > >> I, more or less, use pam-pkcs11. I would really be interested in > >> integrating your RedHat patches. > > > > And I work on the pam_pkcs11 source code righ

Re: [opensc-devel] pam_pkcs11 NSS patch.

2007-05-09 Thread Ludovic Rousseau
On 13/04/07, Robert Relyea <[EMAIL PROTECTED]> wrote: > Here's patch installment 2 of 3. I can't find the needed file security/pam_ext.h in your patch. I guess you forgot to add --new-file when you used diff :-) Can you send the missing file? Bye -- Dr. Ludovic Rousseau _