Public bug reported:
I was following the Ubuntu white paper for setting up smart cards
(SmartCardLogin_WhitePapaer_04.03.20.pdf) and ran into an issue with CRL
checking.
Running on 18.04 server minimal install using package version
0.6.9-2build2
I performed the following steps to install and setup:
* Installed the packages required in the white paper
* Added my Root and Intermediate certificates to /etc/pam_pkcs11/cacerts and
ran pkcs11_make_hash_link
* Installed local versions of the CRLs in /etc/pam_pkcs11/crls and ran
pkcs11_make_hash_link
* Copied and unziped the example config file from
/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz to
/etc/pam_pkcs11/pam_pkcs11.conf
* Modified /etc/pam_pkcs11/pam_pkcs11.conf to use the subject mapper and added
crl_auto to the cert_policy
* Added a subject to the /etc/pam_pkcs11/subject_mapping file
When I try to login as the user I get a segmentation fault and when
running pkcs11_inspect I also get the same fault.
With debugging enabled in the pam config file it tries first to download
the CRLs of the cert and fails it then attempts to use the local crls
and that where it fails.
# pkcs11_inspect
....
DEBUG:cert_vfy.c:229: looking for and dedicated local crl
If is remove crl_auto from the pam config I can authenticate with the user just
fine but there is no crl checking being done.
If I perform a strace of pkcs11_inspect it looks like it is trying to
load a crl that does not exist and fails. There is a recent patch
upstream that seems to address this issue.
#strace pkcs11_inspect
....
stat("/etc/pam_pkcs11/cacerts/37f834c3.r0", 0x7ffecea217b0) = -1 ENOENT (No
such file or directory)
stat("/etc/pam_pkcs11/crls/37f834c3.r0", {st_mode=S_IFREG|0644, st_size=1105,
...}) = 0
openat(AT_FDCWD, "/etc/pam_pkcs11/crls/37f834c3.r0", O_RDONLY) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=1105, ...}) = 0
read(4, "-----BEGIN X509 CRL-----\nMIIDBjC"..., 4096) = 1105
read(4, "", 4096) = 0
close(4) = 0
stat("/etc/pam_pkcs11/crls/37f834c3.r1", 0x7ffecea217b0) = -1 ENOENT (No such
file or directory)
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
+++ killed by SIGSEGV (core dumped) +++
As seen in the logs it inspects crl 37f834c3.r0 but then tries to inspect
37f834c3.r1 which does not exist.
Here is an upstream bug report
https://github.com/OpenSC/pam_pkcs11/issues/43
Here is an upstream pull request
https://github.com/OpenSC/pam_pkcs11/pull/45
#lsb_release -rd
Descripton: Ubuntu 10.04.5 LTS
Release: 18.04
#apt-cache policy pkgname
libpam-pkcs11:
Installed: 0.6.9-2build2
Candidate: 0.6.9-2build2
Version table:
*** 0.6.9-2build2 500
500 http://us.archive.ubuntu.com/ubuntu bionic/universe amd64 Packages
100 /var/lib/dpkg/status
** Affects: pam-pkcs11 (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1907465
Title:
CRL checking of smart card causes Segmentation Fault
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pam-pkcs11/+bug/1907465/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
