Re: Pam-pkcs#11 needs a new maintainer(s) soon, or it will die

Looking at the code, it loos like it is only parsing the certificate
and getting public keys and other values from the certificate.

It does not include rsa.h, but does include bn.h

It looks like it would not take very much effort to use a stripped
down version of the cs-ossl-compat.h from OpenSC
https://github.com/OpenSC/OpenSC/pull/853

I don't use it, so someone is still needed to do some testing.

On 8/22/2016 4:12 AM, Ludovic Rousseau
wrote:

Hello,

After 2 months with no volunteer to take care of pam-pkcs#11
I created a new README.md page on the github project to
indicate the project is no more maintained.

https://github.com/OpenSC/pam_pkcs11/blob/master/README.md

I will also orphan the Debian package.

I guess the Debian (and Ubuntu) package will be remove once
OpenSSL 1.1.0 is included in Debian and pam-pkcs#11 can't be
rebuild.

Regards,

2016-06-30 9:51 GMT+02:00
Ludovic Rousseau <[email protected] >:

Hello,

PAM PKCS#11 [1] is a Pluggable Authentication Module
(PAM) using a

PKCS#11 library (smart card, crypto token, etc.).
The purpose is to be

able to use a smart card to login to a GNU/Linux
system.

With the introduction of OpenSSL 1.1.0 the API has
changed and many

software, including pam-pkcs#11, need to be updated
to use the new

API. For example see [2] for a patch for OpenSC.

I am the only maintainer of pam-pkcs11 project. I do
not use this

software myself any more.

I do not have the free time (and motivation) to
invest in a code

change of pam-pkcs11 to support the new OpenSSL API.

If nobody volunteers to do this work then:

- pam-pkcs11 will not work with OpenSSL 1.1.0

- pam-pkcs11 will be removed from the GNU/Linux
distributions

- pam-pkcs11 will not be usable any more.

A bug [3] has been opened for Debian: "pam-pkcs11:
FTBFS with openssl 1.1.0"

FTBFS is Fails To Build From Source.

When OpenSSL 1.1.0 will be included in Debian
pam-pkcs11 will be

removed from Debian, unless someone adds support of
the new OpenSSL

API.

If you (or your company) use pam-pkcs11 you should
worry about the situation.

RedHat provides [4] pam-pkcs11 to its customers. It
could be a good

idea for RedHat to invest some R&D time to take
maintenance of the

software to keep its (paying) customers happy.

Regards,

[1] https://github.com/OpenSC/pam_pkcs11/wiki

[2] https://github.com/OpenSC/OpenSC/pull/749/files

[3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828487

[4] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html

--

Dr. Ludovic Rousseau

--

Dr. Ludovic Rousseau

------------------------------------------------------------------------------

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel

--

Douglas E. Engert <[email protected]>

------------------------------------------------------------------------------

_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel