Set Up Smart Card Redirection on an Ubuntu Virtual Machine

To configure smart card redirection on an Ubuntu virtual machine (VM), install the libraries on which the feature depends and the root Certificate Authority (CA) certificate to support the trusted authentication of smart cards. In addition, you must edit some configuration files to complete the authentication setup.

Some examples in the procedure use placeholder values to represent entities in your network configuration, such as the DNS name of your AD domain. Replace the placeholder values with information specific to your configuration, as described in the following table.

Prerequisites

Integrate an Ubuntu Virtual Machine with Active Directory for Smart Card Redirection

Procedure

1. Install the required libraries on the Ubuntu VM.

   apt-get install -y pcscd pcsc-tools pkg-config libpam-pkcs11 opensc 
        libengine-pkcs11-openssl libnss3-tools
   

2. Install a root CA certificate.

   1. Download a root CA certificate and save it to /tmp/certificate.cer on the Ubuntu VM. See How to Export Root Certification Authority Certificate.

   2. Locate the root CA certificate that you downloaded, and transfer it to a .pem file.

      openssl x509 -inform der -in /tmp/certificate.cer -out /tmp/certificate.pem
      

   3. Use the certutil command to install the root CA certificate to the system database /etc/pki/nssdb.

      Replace "root CA cert" in the following example command with the name of the root CA certificate in the system database.

      certutil -A -d /etc/pki/nssdb -n "root CA cert" -t "CT,C,C" -i /tmp/certificate.pem
      

   4. Copy the root CA certificate to the /etc/pam_pkcs11/cacerts directory.

      mkdir -p /etc/pam_pkcs11/cacerts
      
      cp /tmp/certificate.pem /etc/pam_pkcs11/cacerts
      

3. Create a pkcs11 hash file.

   chmod a+r certificate.pem
   pkcs11_make_hash_link
   

4. Copy the required drivers and add the necessary library files to the nssdb directory.

   1. Run commands similar to the following example.

      These example commands show how to add libcmP11.so, the driver file for the Gemalto PIV 2.0 card, to the nssdb directory. In place of libcmP11.so, you can substitute the driver file for your smart card.

      cp libcmP11.so /usr/lib/
      mkdir -p /etc/pki/nssdb
      certutil -N -d /etc/pki/nssdb
      certutil -A -n rootca -i certificate.pem -t "CT,CT,CT" -d /etc/pki/nssdb
      modutil -dbdir /etc/pki/nssdb/  -add "piv card 2.0" -libfile /usr/lib/libcmP11.so
      

   2. Verify that the expected certificate is loaded successfully by running the following command.

      # certutil -L -d /etc/pki/nssdb
      

      Verify that the command returns output similar to the following example.

      Certificate Nickname
      rootca
      

   3. Verify that the expected libraries are added successfully by running the following command.

      modutil -dbdir /etc/pki/nssdb -list
      

      Verify that the command returns output similar to the following example.

      Listing of PKCS #11 Modules
      –-----------------------------------------------------------
        1. NSS Internal PKCS #11 Module
               slots: 2 slots attached
              status: loaded
      
               slot: NSS Internal Cryptographic Services
              token: NSS Generic Crypto Services
      
               slot: NSS User Private Key and Certificate Services
              token: NSS Certificate DB
      
        2. piv card 2.0
              library name: /usr/lib/libcmP11.so
               slots: There are no slots attached to this module
              status: loaded
      –-----------------------------------------------------------
      

5. Configure the pam_pkcs11 library.

   1. Create a pam_pkcs11.conf file using default example content.

      • For Ubuntu 18.04 or 20.04, run the following command sequence.

        mkdir /etc/pam_pkcs11
        zcat /usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz | tee /etc/pam_pkcs11/pam_pkcs11.conf
        

      • For Ubuntu 20.04.1 or later, run the following command sequence.

        mkdir /etc/pam_pkcs11
        cat /usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example | tee /etc/pam_pkcs11/pam_pkcs11.conf
        

   2. Edit the /etc/pam_pkcs11/pam_pkcs11.conf file as shown in the following example.

      use_pkcs11_module = mysc;                            
              
      pkcs11_module mysc {                                 
                    module = /usr/lib/libcmP11.so;         
                    description = "LIBCMP11";               
                    slot_num = 0;                           
                    ca_dir = /etc/pam_pkcs11/cacerts;       
                    nss_dir = /etc/pki/nssdb;        
                    cert_policy = ca;                       
      }                                                    
      ...
      use_mappers = cn, null;                        
      ...
      mapper cn {
            debug = false;
            module = internal;
            # module = /lib/pam_pkcs11/cn_mapper.so;
            ignorecase = true;
            mapfile = file:///etc/pam_pkcs11/cn_map;         
            # mapfile = "none";
      }
      

   3. Edit the /etc/pam_pkcs11/cn_map file so that it includes the following line.

      Common name -> Login ID
      

6. Edit the /etc/pam.d/gdm-password configuration file. Place the pam_pkcs11.so authorization line before the common-auth line, as shown in the following example.

   #%PAM-1.0
   auth    requisite       pam_nologin.so
   auth    required        pam_succeed_if.so user != root quiet_success
   auth sufficient pam_pkcs11.so                                                                               
   @include common-auth
   auth    optional        pam_gnome_keyring.so
   @include common-account
   

7. To verify the smart card hardware and the certificates installed on the smart card, run the following commands.

   pcsc_scan
   pkcs11_listcerts
   pkcs11_inspect
   

8. To support the smart card single sign-on (SSO) feature, configure the viewagent-greeter.conf file. See Setting Options in Configuration Files on a Linux Desktop.

9. Configure the pcscd service to start automatically after the VM restarts.

   Note: If the pcscd service does not start after the VM restarts, the first login attempt through pam_pkcs11 fails.

   1. Edit the /lib/systemd/system/pcscd.service file by adding the line WantedBy=multi-user.target to the [Install] section.

      Verify that the edited file resembles the following example.

      [Unit]
      Description=PC/SC Smart Card Daemon
      Requires=pcscd.socket
      
      [Service]
      ExecStart=/usr/sbin/pcscd --foreground --auto-exit
      ExecReload=/usr/sbin/pcscd --hotplug
      
      [Install]
      WantedBy=multi-user.target
      Also=pcscd.socket
      

   2. Enable the pcscd service.

      systemctl enable pcscd.service
      

10. Install the Horizon Agent package, with smart card redirection enabled.

    sudo ./install_viewagent.sh -m yes
    

    Note: If you get an error message instructing you to install the default PC/SC Lite library, uninstall the custom PC/SC Lite library that is currently present on the machine and install the default PC/SC Lite library using the following command.

    apt-get install --reinstall pcscd libpcsclite1
    

    You can then run the Horizon Agent installer.

11. If you are using a custom PC/SC Lite library, configure the pcscd.maxReaderContext and pcscd.readBody options in the config file.

    See Setting Options in Configuration Files on a Linux Desktop.

12. Restart the Ubuntu VM and log back in.