Smartcard not seen when reinserted

[Matthias Apitz]

El día lunes, octubre 02, 2017 a las 01:35:16p. m. +0200, Franck Routier escribió:

> My problem, in addition to the pin being cached "forever" (as long as
> the card is inserted, with no time limit), is that when I remove and
> reinsert the card, it is not recognized unless I restart gpg-agent.
> 
> So here is what happens:
> 
> card inserted
> pam_poldi.so called (sudo)   --> PIN requested
> pam_poldi.so called (sudo)   --> no PIN requested 
> pam_poldi.so called (sudo)   --> no PIN requested
> card removed (I don't like to let my card inserted, with no PIN
> validation needed !)
> card inserted                        --> card not seen (card error,
> OpenPGP card unavailable)
> gpgconf --kill gpg-agent       --> card seen
> pam_poldi.so called (sudo)   --> PIN requested
> pam_poldi.so called (sudo)   --> no PIN requested 
> etc...
> 
> Hence my questions:
> 1) can I force PIN for authentication each time I use it (it seems that
> the forcesig option is for signature only, not for authentication)
> 2) what can I do to have my card recognized on reinsert, without
> ressorting to killing gpg-agent
>     --> probably with some scd-event magic that's beyond my know-how for
> now...

I'm using the attach 'scd-event' script to lock my display on card
removal and to unlock it on card-insert. The real work in the script is
at line 107++

Maybe it can serve you a bit.

	matthias

-- 
Matthias Apitz, ✉ guru at unixarea.de, ⌂ http://www.unixarea.de/  ☎ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub
8. Mai 1945: Wer nicht feiert hat den Krieg verloren.
8 de mayo de 1945: Quien no festeja perdió la Guerra.
May 8, 1945: Who does not celebrate lost the War.
-------------- next part --------------
#!/bin/sh
#
# this script must be placed into GNUPGHOME dir and named 'scd-event';
# it is triggered by the scdaemon on card removal with the arg 'NOCARD'
# it will also run delayd after card insertion and *after* the first access to the card
#
# we use this to lock the KDE screen on card removal and run a loop of
# 'gpg2 --card-status' to unlock the screen after card insertion
#
# guru at unxarea.de, July 2017

echo $0 $* >> /tmp/scd-event.log

PGM=scd-event

reader_port=
old_code=0x0000
new_code=0x0000
status=

tick='`'
prev=
while [ $# -gt 0 ]; do
  arg="$1"
  case $arg in
      -*=*) optarg=$(echo "X$arg" | sed -e '1s/^X//' -e 's/[-_a-zA-Z0-9]*=//')
            ;;
         *) optarg=
            ;;
  esac
  if [ -n "$prev" ]; then
    eval "$prev=\$arg"
    prev=
    shift
    continue
  fi
  case $arg in
      --help|-h)
          cat <<EOF
Usage: $PGM [options]
$PGM is called by scdaemon on card reader status changes

Options:
  --reader-port N        Reports change for port N
  --old-code 0xNNNN      Previous status code
  --old-code 0xNNNN      Current status code
  --status USABLE|ACTIVE|PRESENT|NOCARD 
                         Human readable status code

Environment:

GNUPGHOME=DIR            Set to the active homedir

EOF
          exit 0
          ;;
    
      --reader-port)  
          prev=reader_port
          ;;
      --reader-port=*)
          reader_port="$optarg"
          ;;
      --old-code)  
          prev=old_code
          ;;
      --old-code=*)
          old_code="$optarg"
          ;;
      --new-code)  
          prev=new_code
          ;;
      --new-code=*)
          new_code="$optarg"
          ;;
      --status)  
          prev=status
          ;;
      --new-code=*)
          status="$optarg"
          ;;

      -*)
          echo "$PGM: invalid option $tick$arg'" >&2
          exit 1
          ;;

      *)
          break
          ;;
  esac
  shift
done
if [ -n "$prev" ]; then
  echo "$PGM: argument missing for option $tick$prev'" >&2
  exit 1
fi

cat <<EOF >> /tmp/scd-event.log
========================
port:     $reader_port
old-code: $old_code
new-code: $new_code
status:   $status
EOF

DISPLAY=:0 export DISPLAY
if [ x$status = xNOCARD ]; then
    echo DISPLAY: $DISPLAY >> /tmp/scd-event.log
    echo /usr/local/lib/kde4/libexec/kscreenlocker_greet --immediateLock >> /tmp/scd-event.log
    nohup /usr/local/lib/kde4/libexec/kscreenlocker_greet --immediateLock &
    pid=$!
    echo ${pid}  > /tmp/scd-event.pid
    echo locked by PID ${pid} >> /tmp/scd-event.log
    echo killing fetchmail >> /tmp/scd-event.log
    fetchmail -q
    while true; do
      # is the kscreenlocker_greet still running? user might have unlocked it with PAM
      /bin/kill -0 ${pid} || {
        echo kscreenlocker_greet ${pid} disappeared >> /tmp/scd-event.log
	break
      }
      # gpg2 --card-status >> /tmp/scd-event.log 2>> /tmp/scd-event.log
      # Signature key ....: 5E69 FBAC 1618 562C B3CB  FBC1 47CC F7E4 76FE 9D11
      gpg2 --card-status | grep '5E69 FBAC 1618 562C B3CB  FBC1 47CC F7E4 76FE 9D11' >> /tmp/scd-event.log  && {
        # OK, key is fine unlocking the movies
        echo OK, key is fine unlocking the movies, killall kscreenlocker_greet >> /tmp/scd-event.log
        killall kscreenlocker_greet
	fetchmail
        break
      }
      sleep 1  
    done
fi
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: </pipermail/attachments/20171002/47f33abd/attachment.sig>