<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><font face="DejaVu Sans">Hi there,</font></p>
<p>I'm the proud owner of a Nitrokey Pro OpenPGP card that works
fine for encryption and SSH authentication. I'd love to use it for
sudo/login operations as well, but I've had no luck so far in
setting up Poldi for PAM authentication.</p>
<p>Would you please let me know what I missed, or maybe how I could
further investigate?<br>
</p>
<p>Here is what I did:<br>
</p>
<ul>
<li>My card contains 4096 bit encryption, signing and
authentication subkeys.</li>
<li>I'm using GnuPG v2.1.15 on a regular Ubuntu 17.10 desktop.<br>
</li>
<li>Poldi was installed via the Ubuntu 17.10 "libpam-poldi"
package.</li>
<li>I've associated the card Application ID with my system
username within "/etc/poldi/localdb/users".</li>
<li>I've exported my public authentication subkey in a file named
after the card Application ID within "/etc/poldi/localdb/keys/".
Since "poldi-ctrl" is no longer available, and
'gpg-connect-agent "/datafile <app_id>" "SCD READKEY
--advanced OPENPGP.3" "/bye"' would only yield "ERR 100663414
Invalid ID <SCD>", I've been using "gpg --export |
openpgp2ssh <auth_subkey_fp> | ssh-conv | sexp-conv
--syntax=hex" to produce the appropriate format, i.e.
"(public-key (rsa-pkcs1-sha1 (n #00e2 ... 7#) (e #010001#)))".<br>
</li>
<li>I've replaced "@include common-auth" with "auth sufficient
pam_poldi.so" in "/etc/pam.d/sudo".</li>
</ul>
And this is where I stand:<br>
<ul>
<li>"sudo ls" is unsuccessful, though the card LED lights up (and
the PIN is correct):<br>
Insert authentication card for user `syl'<br>
Trying authentication as user `syl'...<br>
Please enter the PIN<br>
Sorry, try again.<br>
Insert authentication card for user `syl'<br>
Trying authentication as user `syl'...<br>
Sorry, try again.<br>
Insert authentication card for user `syl'<br>
Trying authentication as user `syl'...<br>
sudo: 3 incorrect password attempts</li>
<li>"/var/log/poldi.log" doesn't give much details (card serial
number edited by me):<br>
Poldi 2018-02-02 17:19:53 [23950] debug: using authentication
method `localdb'<br>
Poldi 2018-02-02 17:19:54 [23950] debug: got scdaemon socket
name from gpg-agent, connected to socket
'/run/user/1000/gnupg/S.scdaemon'<br>
Poldi 2018-02-02 17:19:56 [23950] debug: Waiting for card for
user `syl'...<br>
Poldi 2018-02-02 17:19:58 [23950] debug: connected to card;
serial number is: D...0<br>
Poldi 2018-02-02 17:19:58 [23950] debug: Trying authentication
as user `syl'...<br>
Poldi 2018-02-02 17:20:06 [23950] error: failed to verify
challenge<br>
Poldi 2018-02-02 17:20:06 [23950] error: authentication failed:
General error<br>
Poldi 2018-02-02 17:20:06 [23950] debug: using authentication
method `localdb'<br>
Poldi 2018-02-02 17:20:06 [23950] debug: got scdaemon socket
name from gpg-agent, connected to socket
'/run/user/1000/gnupg/S.scdaemon'<br>
Poldi 2018-02-02 17:20:06 [23950] debug: Waiting for card for
user `syl'...<br>
Poldi 2018-02-02 17:20:06 [23950] debug: connected to card;
serial number is: D...0<br>
Poldi 2018-02-02 17:20:06 [23950] debug: Trying authentication
as user `syl'...<br>
Poldi 2018-02-02 17:20:10 [23950] error: failed to verify
challenge<br>
Poldi 2018-02-02 17:20:10 [23950] error: authentication failed:
General error<br>
Poldi 2018-02-02 17:20:10 [23950] debug: using authentication
method `localdb'<br>
Poldi 2018-02-02 17:20:10 [23950] debug: got scdaemon socket
name from gpg-agent, connected to socket
'/run/user/1000/gnupg/S.scdaemon'<br>
Poldi 2018-02-02 17:20:10 [23950] debug: Waiting for card for
user `syl'...<br>
Poldi 2018-02-02 17:20:10 [23950] debug: connected to card;
serial number is: D...0<br>
Poldi 2018-02-02 17:20:10 [23950] debug: Trying authentication
as user `syl'...<br>
Poldi 2018-02-02 17:20:13 [23950] error: failed to verify
challenge<br>
Poldi 2018-02-02 17:20:13 [23950] error: authentication failed:
General error</li>
<li>For the record, "/etc/poldi/poldi.conf" reads as follows:<br>
auth-method localdb<br>
log-file /var/log/poldi.log<br>
debug</li>
</ul>
<p>Thanks in advance for your help, best regards,</p>
<p>--Syl</p>
</body>
</html>