🔐 Implementing Smart Card Authentication on Alpine Linux: Advanced Security

Let’s implement enterprise-grade smart card authentication on Alpine Linux! 🚀 This comprehensive tutorial shows you how to set up PKI-based smart card authentication with PKCS#11, PAM integration, and advanced security policies. Perfect for organizations requiring high-security multi-factor authentication and certificate-based access control! 😊

🤔 What is Smart Card Authentication?

Smart card authentication is a multi-factor security system that uses cryptographic smart cards containing digital certificates and private keys to verify user identity, providing strong authentication that combines something you have (the card) with something you know (a PIN)!

Smart card authentication is like:

• 🗝️ High-security vault key that requires both physical possession and knowledge to unlock
• 🛡️ Digital fortress where entry requires multiple layers of cryptographic verification
• 🎫 VIP access pass that contains encrypted credentials impossible to duplicate or forge

🎯 What You Need

Before we start, you need:

• ✅ Alpine Linux system with USB or card reader hardware support
• ✅ Smart cards (PKCS#11 compatible) and card reader device
• ✅ Understanding of PKI concepts, certificates, and cryptography
• ✅ Root access for system authentication configuration

📋 Step 1: Install Smart Card Infrastructure

Install Core Smart Card Packages

Let’s set up the smart card foundation! 😊

What we’re doing: Installing PKCS#11 libraries, OpenSC middleware, and smart card reader drivers for comprehensive smart card support.

# Update package list
apk update

# Install smart card core packages
apk add opensc opensc-pkcs11
apk add pcsc-lite pcsc-lite-dev
apk add ccid

# Install cryptographic libraries
apk add openssl openssl-dev
apk add gnutls gnutls-dev
apk add p11-kit p11-kit-dev

# Install PAM integration
apk add linux-pam-dev
apk add libpam-pkcs11

# Install USB and hardware support
apk add libusb libusb-dev
apk add udev eudev-dev

# Install additional card reader drivers
apk add pcsc-tools
apk add pcsc-cyberjack  # For specific card readers
apk add openct          # Alternative smart card tools

# Install development tools
apk add gcc make pkgconfig
apk add autoconf automake libtool

# Enable and start PC/SC daemon
rc-update add pcscd default
service pcscd start

# Test smart card reader detection
pcsc_scan

echo "Smart card infrastructure installed! 🏗️"

What this does: 📖 Installs complete smart card middleware stack with reader support and cryptographic libraries.

Example output:

PC/SC device scanner
Scanning present readers...
0: Generic USB Smart Card Reader Interface [CCID Interface] (55041234) 00 00
Smart card infrastructure installed! 🏗️

What this means: Smart card hardware is detected and ready for configuration! ✅

Configure PKCS#11 Modules

Let’s set up PKCS#11 cryptographic modules! 🎯

What we’re doing: Configuring PKCS#11 modules for smart card access, certificate management, and cryptographic operations.

# Configure OpenSC PKCS#11 module
cat > /etc/opensc/opensc.conf << 'EOF'
# OpenSC Configuration for Smart Card Authentication
app = "default";
debug = 0;
debug_file = "/var/log/opensc-debug.log";

# Card drivers configuration
card_drivers = "openpgp", "piv", "cac", "muscle", "mcrd", "setcos", "starcos", "tcos", "cyberflex", "gemsafeV1", "acos5", "authentic", "entersafe", "epass2003", "rutoken", "westcos", "myeid";

# Card ATR configuration
card_atr "3b:7d:94:00:00:80:31:80:65:b0:83:11:d0:a9:83:00:90:00" {
    name = "PIV Card";
    driver = "piv";
}

card_atr "3b:fc:13:00:00:81:31:fe:15:59:75:62:69:6b:65:79:34:d0:0a" {
    name = "YubiKey 4";
    driver = "piv";
}

# Framework configuration
framework "pkcs15" {
    use_file_caching = true;
    file_cache_dir = "/tmp/.eid";
    use_pin_caching = true;
    pin_cache_counter = 10;
    pin_cache_ignore_user_consent = true;
}

# PIV framework
framework "piv" {
    enable = yes;
}

# Reader configuration
reader_driver "pcsc" {
    enable_pinpad = true;
    enable_pace = true;
    connect_exclusive = true;
}
EOF

# Create p11-kit configuration for module registration
mkdir -p /etc/pkcs11/modules

cat > /etc/pkcs11/modules/opensc.module << 'EOF'
# OpenSC PKCS#11 Module Configuration
module: /usr/lib/opensc-pkcs11.so
critical: no
trust-policy: yes
log-calls: no
enable-in: all
EOF

# Configure p11-kit trust store
cat > /etc/pkcs11/pkcs11.conf << 'EOF'
# PKCS#11 Configuration
user-config: ~/.config/pkcs11
module-path: /usr/lib/pkcs11

# Module search paths
[p11-kit]
max-cache-size: 16384
modules-dir: /etc/pkcs11/modules

# Trust module
[opensc]
library: /usr/lib/opensc-pkcs11.so
trust-policy: yes
enable-in: all
EOF

# Test PKCS#11 module installation
pkcs11-tool --list-slots

# List available mechanisms
pkcs11-tool --list-mechanisms

echo "PKCS#11 modules configured! 🔧"

What this does: 📖 Sets up PKCS#11 cryptographic interface for smart card operations and certificate management.

Example output:

Available slots:
Slot 0 (0x0): Generic USB Smart Card Reader Interface [CCID Interface] (55041234) 00 00
  token state:   uninitialized
PKCS#11 modules configured! 🔧

What this means: PKCS#11 interface is ready for smart card operations! ✅

📋 Step 2: Configure Certificate Management

Set Up PKI Certificate Infrastructure

Let’s implement certificate management! 😊

What we’re doing: Setting up certificate authority, certificate enrollment, and management infrastructure for smart card PKI authentication.

# Create PKI directory structure
mkdir -p /opt/smartcard-pki/{ca,certs,private,crl,newcerts}
cd /opt/smartcard-pki

# Set proper permissions
chmod 700 private
chmod 755 certs crl newcerts

# Create CA configuration
cat > ca.conf << 'EOF'
# Smart Card PKI Certificate Authority Configuration
[ ca ]
default_ca = CA_default

[ CA_default ]
dir               = /opt/smartcard-pki
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
RANDFILE          = $dir/private/.rand

private_key       = $dir/private/ca.key.pem
certificate       = $dir/certs/ca.cert.pem
crlnumber         = $dir/crlnumber
crl               = $dir/crl/ca.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30
default_md        = sha256
preserve          = no
policy            = policy_strict

[ policy_strict ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
default_bits        = 4096
distinguished_name  = req_distinguished_name
string_mask         = utf8only
default_md          = sha256
x509_extensions     = v3_ca

[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
stateOrProvinceName            = State or Province Name
localityName                   = Locality Name
0.organizationName             = Organization Name
organizationalUnitName         = Organizational Unit Name
commonName                     = Common Name
emailAddress                   = Email Address

[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "Smart Card User Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection, smartCardLogon

[ smartcard_cert ]
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "Smart Card Authentication Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, smartCardLogon
certificatePolicies = 1.2.3.4.5.6.7.8.1
EOF

# Initialize CA database
touch index.txt
echo 1000 > serial
echo 1000 > crlnumber

# Generate CA private key
openssl genrsa -aes256 -out private/ca.key.pem 4096
chmod 400 private/ca.key.pem

# Generate CA certificate
openssl req -config ca.conf \
    -key private/ca.key.pem \
    -new -x509 -days 7300 -sha256 -extensions v3_ca \
    -out certs/ca.cert.pem \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=Smart Card CA"

chmod 444 certs/ca.cert.pem

# Verify CA certificate
openssl x509 -noout -text -in certs/ca.cert.pem

echo "PKI Certificate Authority created! 🏛️"

What this does: 📖 Creates complete PKI infrastructure for smart card certificate management and authentication.

Example output:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:8a:fd:1e:3c:0a:4f:2f:65:bc:93:1e:11:b0:d9:8f:2a:3b:4c:8e
    Subject: C = US, ST = State, L = City, O = Organization, CN = Smart Card CA
PKI Certificate Authority created! 🏛️

What this means: Certificate Authority is ready for smart card certificate issuance! ✅

Create Smart Card Certificate Management Tools

Let’s build certificate management utilities! 🎯

What we’re doing: Creating tools for certificate enrollment, smart card initialization, and certificate lifecycle management.

# Create smart card management toolkit
mkdir -p /opt/smartcard-tools
cd /opt/smartcard-tools

# Create card initialization script
cat > initialize-smartcard.sh << 'EOF'
#!/bin/bash

# Smart Card Initialization Script
set -e

CARD_LABEL=${1:-"SmartCard"}
USER_NAME=${2:-"user"}
PIN=${3:-"123456"}
PUK=${4:-"12345678"}

echo "🔐 Initializing Smart Card: $CARD_LABEL"
echo "User: $USER_NAME"

# Check for card presence
if ! pkcs11-tool --list-slots | grep -q "token state"; then
    echo "❌ No smart card detected. Please insert card and try again."
    exit 1
fi

# Initialize card (this will erase existing data)
echo "⚠️  WARNING: This will erase all data on the smart card!"
read -p "Continue? (y/N): " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
    echo "Cancelled."
    exit 1
fi

# Initialize PKCS#15 structure
pkcs15-init --create-pkcs15 --profile pkcs15+onepin \
    --label "$CARD_LABEL" \
    --pin "$PIN" --puk "$PUK"

echo "✅ Smart card initialized successfully!"
echo "PIN: $PIN"
echo "PUK: $PUK"
EOF

# Create certificate enrollment script
cat > enroll-certificate.sh << 'EOF'
#!/bin/bash

# Smart Card Certificate Enrollment Script
set -e

USER_NAME=${1:-"user"}
EMAIL=${2:-"[email protected]"}
PIN=${3:-"123456"}
KEY_SIZE=${4:-"2048"}

PKI_DIR="/opt/smartcard-pki"
TEMP_DIR="/tmp/smartcard-enrollment"

echo "📝 Enrolling certificate for: $USER_NAME"

# Create temporary directory
mkdir -p $TEMP_DIR
cd $TEMP_DIR

# Generate private key on smart card
echo "🔑 Generating key pair on smart card..."
pkcs15-init --generate-key "rsa/$KEY_SIZE" \
    --auth-id 01 --id 01 \
    --label "Authentication Key" \
    --pin "$PIN"

# Generate certificate request
echo "📋 Generating certificate request..."
pkcs11-tool --keypairgen --key-type rsa:$KEY_SIZE \
    --login --pin "$PIN" \
    --label "Authentication Key" --id 01

# Extract public key for CSR
openssl req -new -engine pkcs11 -keyform engine \
    -key "01" \
    -out "$USER_NAME.csr" \
    -subj "/C=US/ST=State/L=City/O=Organization/CN=$USER_NAME/emailAddress=$EMAIL"

# Sign certificate with CA
cd $PKI_DIR
openssl ca -config ca.conf \
    -extensions smartcard_cert \
    -days 365 -notext -md sha256 \
    -in "$TEMP_DIR/$USER_NAME.csr" \
    -out "certs/$USER_NAME.cert.pem" \
    -passin pass:capassword

# Install certificate on smart card
pkcs15-init --store-certificate "certs/$USER_NAME.cert.pem" \
    --auth-id 01 --id 01 \
    --label "Authentication Certificate" \
    --pin "$PIN"

# Clean up
rm -rf $TEMP_DIR

echo "✅ Certificate enrolled successfully!"
echo "Certificate: $PKI_DIR/certs/$USER_NAME.cert.pem"
EOF

# Create card verification script
cat > verify-smartcard.sh << 'EOF'
#!/bin/bash

# Smart Card Verification Script
PIN=${1:-"123456"}

echo "🔍 Smart Card Verification Report"
echo "=" * 40

# Check card reader
echo "📱 Card Reader Status:"
pcsc_scan -n | head -10

# List available slots
echo -e "\n🎰 Available Slots:"
pkcs11-tool --list-slots

# List objects on card (if PIN provided)
if [ -n "$PIN" ]; then
    echo -e "\n🗂️  Card Objects:"
    pkcs11-tool --login --pin "$PIN" --list-objects
    
    echo -e "\n🔐 Certificates:"
    pkcs11-tool --login --pin "$PIN" --list-certs
    
    echo -e "\n🗝️  Private Keys:"
    pkcs11-tool --login --pin "$PIN" --list-keys --type privkey
fi

# Test authentication
echo -e "\n🧪 Authentication Test:"
if pkcs11-tool --login --pin "$PIN" --test; then
    echo "✅ Authentication successful!"
else
    echo "❌ Authentication failed!"
fi

echo -e "\nVerification completed!"
EOF

# Create certificate backup script
cat > backup-certificates.sh << 'EOF'
#!/bin/bash

# Smart Card Certificate Backup Script
BACKUP_DIR="/opt/smartcard-backup/$(date +%Y%m%d_%H%M%S)"
PIN=${1:-"123456"}

echo "💾 Creating smart card certificate backup..."

mkdir -p "$BACKUP_DIR"

# Backup certificates
echo "Backing up certificates..."
pkcs11-tool --login --pin "$PIN" \
    --read-object --type cert \
    --output-file "$BACKUP_DIR/certificate.der"

# Backup public keys
echo "Backing up public keys..."
pkcs11-tool --login --pin "$PIN" \
    --read-object --type pubkey \
    --output-file "$BACKUP_DIR/pubkey.der"

# Create backup metadata
cat > "$BACKUP_DIR/metadata.txt" << EOL
Smart Card Backup Metadata
Created: $(date)
Card Label: $(pkcs11-tool --list-slots | grep 'token label' | cut -d: -f2)
Serial: $(pkcs11-tool --list-slots | grep 'token serial' | cut -d: -f2)
EOL

echo "✅ Backup created: $BACKUP_DIR"
EOF

# Make scripts executable
chmod +x *.sh

echo "Smart card management tools created! 🛠️"

What this does: 📖 Creates comprehensive smart card management toolkit for initialization, enrollment, and maintenance.

Example output:

Smart card management tools created! 🛠️

What this means: Complete smart card management infrastructure is ready! ✅

📋 Step 3: Configure PAM Authentication Integration

Set Up PAM Smart Card Module

Let’s integrate smart cards with system authentication! 😊

What we’re doing: Configuring PAM (Pluggable Authentication Modules) to use smart cards for system login, sudo access, and application authentication.

# Install and configure pam_pkcs11
# First, let's create the configuration directory
mkdir -p /etc/pam_pkcs11

# Create pam_pkcs11 configuration
cat > /etc/pam_pkcs11/pam_pkcs11.conf << 'EOF'
# PAM PKCS#11 Configuration for Smart Card Authentication

# PKCS#11 module configuration
pkcs11_module {
    module = /usr/lib/opensc-pkcs11.so;
    description = "OpenSC PKCS#11 Module";
    slot_description = "none";
    support_threads = false;
    ca_dir = "/opt/smartcard-pki/certs";
    crl_dir = "/opt/smartcard-pki/crl";
    support_threads = false;
    init_args = none;
    waittime = 300;
    locate_certificate_on_card = true;
}

# Certificate verification options
verify {
    # Verify certificate chain
    verify_signature = true;
    verify_expiration = true;
    
    # CRL verification
    crl_policy = none;
    
    # Certificate policies
    cert_policy {
        # Certificate verification
        signature = true;
        ca = true;
        crl_auto = false;
        crl_offline = false;
        crl_url = false;
        ocsp_on = false;
        
        # Certificate matching
        cert_serial = false;
        cert_cn = false;
        cert_digest = false;
        ldap_on = false;
        ldap_server = "ldap://localhost:389";
        ldap_scope = 2;
        ldap_filter = "(&(objectClass=posixAccount)(cn=%s))";
        ldap_binddn = "";
        ldap_passwd = "";
    }
}

# User mapping configuration
mapper {
    debug = false;
    
    # Map certificate to username
    mapfile = "/etc/pam_pkcs11/subject_mapping";
    ignorecase = false;
    
    # Mapping modules
    use_mappers = "pwent";
    
    mapper_pwent {
        debug = false;
        ignorecase = false;
    }
    
    mapper_ldap {
        debug = false;
        ldapserver = "ldap://localhost:389";
        ldapport = 389;
        scope = 2;
        binddn = "cn=pam,dc=example,dc=com";
        passwd = "";
        base = "dc=example,dc=com";
        filter = "(&(objectClass=posixAccount)(userCertificate;binary=%s))";
        attribute = "uid";
    }
    
    mapper_openssh {
        debug = false;
        sshdir = "%s/.ssh";
    }
    
    mapper_opensc {
        debug = false;
        module = /usr/lib/opensc-pkcs11.so;
        ignorecase = false;
    }
}

# Screen saver integration
screensaver {
    enable_screensaver = false;
    screensaver = "xscreensaver";
    policy = "none";
}
EOF

# Create subject mapping file
cat > /etc/pam_pkcs11/subject_mapping << 'EOF'
# Subject Mapping Configuration
# Maps certificate subjects to usernames
# Format: certificate_subject -> username

# Example mappings
"C=US, ST=State, L=City, O=Organization, CN=John Doe, [email protected]" -> john
"C=US, ST=State, L=City, O=Organization, CN=Jane Smith, [email protected]" -> jane
"C=US, ST=State, L=City, O=Organization, CN=Admin User, [email protected]" -> admin
EOF

# Create CN mapping file
cat > /etc/pam_pkcs11/cn_mapping << 'EOF'
# Common Name Mapping Configuration
# Maps certificate CN to usernames

# Direct CN mappings
John Doe -> john
Jane Smith -> jane
Admin User -> admin
EOF

# Configure PAM for smart card authentication
# Backup original PAM configuration
cp /etc/pam.d/system-auth /etc/pam.d/system-auth.backup

# Create smart card PAM configuration
cat > /etc/pam.d/smartcard-auth << 'EOF'
# Smart Card Authentication PAM Configuration
auth    required    pam_env.so
auth    sufficient  pam_pkcs11.so wait_for_card card_only
auth    required    pam_deny.so

account sufficient  pam_pkcs11.so
account required    pam_permit.so

password required   pam_deny.so

session required    pam_limits.so
session required    pam_unix.so
session optional    pam_keyinit.so force revoke
EOF

# Update system authentication to include smart card
cat > /etc/pam.d/system-auth << 'EOF'
# System Authentication with Smart Card Support
auth        required      pam_env.so
auth        sufficient    pam_pkcs11.so wait_for_card try_first_pass
auth        sufficient    pam_unix.so try_first_pass nullok
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
EOF

# Configure sudo to use smart card authentication
cat > /etc/pam.d/sudo << 'EOF'
# Sudo with Smart Card Authentication
auth        sufficient    pam_pkcs11.so wait_for_card
auth        include       system-auth
account     include       system-auth
password    include       system-auth
session     include       system-auth
EOF

echo "PAM smart card integration configured! 🔐"

What this does: 📖 Integrates smart card authentication with system PAM for login and privilege escalation.

Example output:

PAM smart card integration configured! 🔐

What this means: System authentication now supports smart card login! ✅

Configure SSH Smart Card Authentication

Let’s enable SSH smart card support! 🎯

What we’re doing: Configuring SSH server and client to use smart card certificates for secure remote authentication.

# Configure SSH server for smart card authentication
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

# Update SSH server configuration
cat >> /etc/ssh/sshd_config << 'EOF'

# Smart Card Authentication Configuration
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

# X.509 Certificate authentication
TrustedUserCAKeys /opt/smartcard-pki/certs/ca.cert.pem
AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u

# PKCS#11 authentication
PKCS11Provider /usr/lib/opensc-pkcs11.so

# Enhanced security
PasswordAuthentication no
ChallengeResponseAuthentication yes
UsePAM yes

# Certificate-based host authentication
HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
TrustedUserCAKeys /opt/smartcard-pki/certs/ca.cert.pem

# Logging
LogLevel VERBOSE
SyslogFacility AUTH
EOF

# Create authorized principals directory
mkdir -p /etc/ssh/auth_principals

# Create example authorized principals file
cat > /etc/ssh/auth_principals/john << 'EOF'
[email protected]
smartcard-user
EOF

# Configure SSH client for smart card
cat > /etc/ssh/ssh_config.d/smartcard.conf << 'EOF'
# SSH Client Smart Card Configuration
Host *
    PKCS11Provider /usr/lib/opensc-pkcs11.so
    IdentitiesOnly yes
    PreferredAuthentications publickey,keyboard-interactive
    PubkeyAuthentication yes
    
# Smart card specific hosts
Host smartcard-*
    PKCS11Provider /usr/lib/opensc-pkcs11.so
    CertificateFile ~/.ssh/smartcard.crt
    IdentityFile ~/.ssh/smartcard
EOF

# Create SSH key extraction script
cat > /opt/smartcard-tools/extract-ssh-key.sh << 'EOF'
#!/bin/bash

# Extract SSH Public Key from Smart Card
USER_NAME=${1:-"user"}
PIN=${2:-"123456"}
OUTPUT_DIR=${3:-"$HOME/.ssh"}

echo "🔑 Extracting SSH public key from smart card..."

# Create SSH directory
mkdir -p "$OUTPUT_DIR"

# Extract public key from smart card
ssh-keygen -D /usr/lib/opensc-pkcs11.so > "$OUTPUT_DIR/smartcard.pub"

# Create certificate file
pkcs11-tool --login --pin "$PIN" \
    --read-object --type cert \
    --output-file "/tmp/smartcard.der"

# Convert to PEM format
openssl x509 -inform DER -in /tmp/smartcard.der \
    -out "$OUTPUT_DIR/smartcard.crt"

# Set proper permissions
chmod 600 "$OUTPUT_DIR/smartcard.pub"
chmod 600 "$OUTPUT_DIR/smartcard.crt"

# Clean up
rm /tmp/smartcard.der

echo "✅ SSH key extracted to: $OUTPUT_DIR/smartcard.pub"
echo "✅ Certificate extracted to: $OUTPUT_DIR/smartcard.crt"

# Display public key for authorized_keys
echo -e "\nAdd this to authorized_keys on remote servers:"
cat "$OUTPUT_DIR/smartcard.pub"
EOF

# Create SSH connection test script
cat > /opt/smartcard-tools/test-ssh-smartcard.sh << 'EOF'
#!/bin/bash

# Test SSH Smart Card Authentication
REMOTE_HOST=${1:-"localhost"}
REMOTE_USER=${2:-"$USER"}

echo "🔐 Testing SSH smart card authentication..."
echo "Host: $REMOTE_HOST"
echo "User: $REMOTE_USER"

# Test PKCS#11 provider
echo -e "\n📋 Available keys from smart card:"
ssh-add -l

# Test SSH connection with smart card
echo -e "\n🌐 Testing SSH connection..."
ssh -o PreferredAuthentications=publickey \
    -o PKCS11Provider=/usr/lib/opensc-pkcs11.so \
    -o IdentitiesOnly=yes \
    "$REMOTE_USER@$REMOTE_HOST" \
    "echo 'Smart card SSH authentication successful!'"

if [ $? -eq 0 ]; then
    echo "✅ SSH smart card authentication working!"
else
    echo "❌ SSH smart card authentication failed!"
    echo "Check smart card, PIN, and server configuration."
fi
EOF

chmod +x /opt/smartcard-tools/*.sh

# Restart SSH service
service sshd restart

echo "SSH smart card authentication configured! 🌐"

What this does: 📖 Enables SSH authentication using smart card certificates for secure remote access.

Example output:

SSH smart card authentication configured! 🌐

What this means: SSH now supports smart card-based authentication! ✅

📋 Step 4: Implement Advanced Security Policies

Configure Smart Card Security Policies

Let’s implement enterprise security policies! 😊

What we’re doing: Setting up advanced security policies, audit logging, and compliance controls for smart card authentication systems.

# Create security policy management directory
mkdir -p /opt/smartcard-security
cd /opt/smartcard-security

# Create security policy configuration
cat > security-policy.conf << 'EOF'
# Smart Card Security Policy Configuration

[General]
# Security policy version
policy_version = 2.1
last_updated = 2024-01-01

# Global settings
enforce_pin_policy = true
require_secure_messaging = true
enable_audit_logging = true
session_timeout = 3600

[PIN_Policy]
# PIN requirements
min_pin_length = 6
max_pin_length = 12
require_complex_pin = true
pin_history_count = 5
max_pin_attempts = 3
pin_lockout_time = 1800

# PIN complexity rules
require_digits = true
require_uppercase = false
require_lowercase = false
require_special_chars = false

[Certificate_Policy]
# Certificate validation
verify_certificate_chain = true
check_certificate_revocation = true
enforce_certificate_expiration = true
require_certificate_policies = true

# Certificate requirements
min_key_size = 2048
allowed_key_types = "rsa,ecc"
max_certificate_age_days = 365
require_extended_key_usage = true

[Authentication_Policy]
# Authentication requirements
require_multi_factor = true
enable_biometric_fallback = false
session_management = true
concurrent_session_limit = 1

# Risk-based authentication
enable_risk_assessment = true
unusual_location_check = true
device_fingerprinting = true
time_based_restrictions = true

[Audit_Policy]
# Audit logging
log_authentication_attempts = true
log_certificate_operations = true
log_pin_operations = true
log_administrative_actions = true

# Log retention
audit_log_retention_days = 365
audit_log_max_size_mb = 100
audit_log_rotation = daily

[Compliance]
# Compliance frameworks
fips_140_2_level = 2
common_criteria_level = "EAL4+"
enable_tamper_detection = true
require_secure_boot = true
EOF

# Create security policy enforcer
cat > security-policy-enforcer.py << 'EOF'
#!/usr/bin/env python3

# Smart Card Security Policy Enforcer
import configparser
import logging
import subprocess
import time
import json
from datetime import datetime, timedelta
import os
import hashlib

class SmartCardSecurityEnforcer:
    def __init__(self, config_file="security-policy.conf"):
        self.config = configparser.ConfigParser()
        self.config.read(config_file)
        self.setup_logging()
        self.pin_attempts = {}
        self.active_sessions = {}
        
    def setup_logging(self):
        """Set up audit logging"""
        logging.basicConfig(
            filename="/var/log/smartcard-security.log",
            level=logging.INFO,
            format="%(asctime)s - %(levelname)s - %(message)s"
        )
        self.logger = logging.getLogger(__name__)
    
    def log_security_event(self, event_type, details):
        """Log security events for audit"""
        event = {
            'timestamp': datetime.now().isoformat(),
            'event_type': event_type,
            'details': details,
            'source': 'smartcard_security_enforcer'
        }
        self.logger.info(json.dumps(event))
    
    def validate_pin_policy(self, pin, user_id):
        """Validate PIN against security policy"""
        min_length = self.config.getint('PIN_Policy', 'min_pin_length')
        max_length = self.config.getint('PIN_Policy', 'max_pin_length')
        require_complex = self.config.getboolean('PIN_Policy', 'require_complex_pin')
        
        # Length check
        if len(pin) < min_length or len(pin) > max_length:
            self.log_security_event('pin_policy_violation', 
                                  f'PIN length violation for user {user_id}')
            return False, f"PIN must be between {min_length} and {max_length} characters"
        
        # Complexity check
        if require_complex:
            has_digit = any(c.isdigit() for c in pin)
            if not has_digit:
                self.log_security_event('pin_policy_violation',
                                      f'PIN complexity violation for user {user_id}')
                return False, "PIN must contain at least one digit"
        
        return True, "PIN policy compliant"
    
    def check_pin_attempts(self, user_id):
        """Check PIN attempt limits"""
        max_attempts = self.config.getint('PIN_Policy', 'max_pin_attempts')
        lockout_time = self.config.getint('PIN_Policy', 'pin_lockout_time')
        
        current_time = time.time()
        
        if user_id in self.pin_attempts:
            attempts, last_attempt = self.pin_attempts[user_id]
            
            # Check if lockout period has expired
            if current_time - last_attempt > lockout_time:
                self.pin_attempts[user_id] = [0, current_time]
                return True, "Lockout period expired, attempts reset"
            
            if attempts >= max_attempts:
                self.log_security_event('pin_lockout', 
                                      f'User {user_id} locked out due to too many PIN attempts')
                return False, f"Account locked for {lockout_time} seconds"
        
        return True, "PIN attempts within limits"
    
    def validate_certificate(self, cert_path):
        """Validate certificate against security policy"""
        try:
            # Check certificate expiration
            result = subprocess.run(['openssl', 'x509', '-in', cert_path, '-noout', '-dates'],
                                  capture_output=True, text=True)
            
            if result.returncode != 0:
                return False, "Invalid certificate format"
            
            # Parse expiration date
            for line in result.stdout.split('\n'):
                if 'notAfter' in line:
                    exp_date_str = line.split('=')[1]
                    # Parse and check expiration
                    # Implementation would include proper date parsing
            
            # Check key size
            result = subprocess.run(['openssl', 'x509', '-in', cert_path, '-noout', '-text'],
                                  capture_output=True, text=True)
            
            min_key_size = self.config.getint('Certificate_Policy', 'min_key_size')
            
            if 'RSA Public-Key' in result.stdout:
                # Extract key size and validate
                pass
            
            self.log_security_event('certificate_validation', 
                                  f'Certificate {cert_path} validated successfully')
            return True, "Certificate validation passed"
            
        except Exception as e:
            self.log_security_event('certificate_validation_error',
                                  f'Certificate validation failed: {str(e)}')
            return False, f"Certificate validation error: {str(e)}"
    
    def enforce_session_limits(self, user_id, session_id):
        """Enforce session management policies"""
        max_sessions = self.config.getint('Authentication_Policy', 'concurrent_session_limit')
        session_timeout = self.config.getint('General', 'session_timeout')
        
        current_time = time.time()
        
        # Clean up expired sessions
        if user_id in self.active_sessions:
            active_sessions = []
            for sid, start_time in self.active_sessions[user_id]:
                if current_time - start_time < session_timeout:
                    active_sessions.append((sid, start_time))
            self.active_sessions[user_id] = active_sessions
        else:
            self.active_sessions[user_id] = []
        
        # Check session limits
        if len(self.active_sessions[user_id]) >= max_sessions:
            self.log_security_event('session_limit_exceeded',
                                  f'User {user_id} exceeded session limit')
            return False, "Maximum concurrent sessions exceeded"
        
        # Add new session
        self.active_sessions[user_id].append((session_id, current_time))
        
        self.log_security_event('session_created',
                              f'Session {session_id} created for user {user_id}')
        return True, "Session created successfully"
    
    def assess_authentication_risk(self, user_id, context):
        """Perform risk-based authentication assessment"""
        risk_score = 0
        risk_factors = []
        
        # Check for unusual location
        if self.config.getboolean('Authentication_Policy', 'unusual_location_check'):
            # Implementation would check IP geolocation
            pass
        
        # Check for unusual time
        if self.config.getboolean('Authentication_Policy', 'time_based_restrictions'):
            current_hour = datetime.now().hour
            if current_hour < 6 or current_hour > 22:  # Outside business hours
                risk_score += 20
                risk_factors.append("Outside business hours")
        
        # Device fingerprinting
        if self.config.getboolean('Authentication_Policy', 'device_fingerprinting'):
            # Implementation would check device characteristics
            pass
        
        # Risk assessment
        if risk_score > 50:
            self.log_security_event('high_risk_authentication',
                                  f'High risk authentication for user {user_id}: {risk_factors}')
            return False, f"High risk authentication blocked: {', '.join(risk_factors)}"
        
        return True, "Risk assessment passed"
    
    def generate_compliance_report(self):
        """Generate compliance report"""
        report = {
            'timestamp': datetime.now().isoformat(),
            'policy_version': self.config.get('General', 'policy_version'),
            'fips_level': self.config.get('Compliance', 'fips_140_2_level'),
            'cc_level': self.config.get('Compliance', 'common_criteria_level'),
            'active_users': len(self.active_sessions),
            'total_sessions': sum(len(sessions) for sessions in self.active_sessions.values()),
            'policy_violations': 0  # Would be calculated from logs
        }
        
        with open(f"/var/log/compliance_report_{datetime.now().strftime('%Y%m%d')}.json", 'w') as f:
            json.dump(report, f, indent=2)
        
        return report

def main():
    enforcer = SmartCardSecurityEnforcer()
    
    print("🛡️ Smart Card Security Policy Enforcer Started")
    
    # Example usage
    user_id = "john"
    pin = "123456"
    
    # Validate PIN policy
    valid, message = enforcer.validate_pin_policy(pin, user_id)
    print(f"PIN validation: {valid} - {message}")
    
    # Check authentication attempts
    allowed, message = enforcer.check_pin_attempts(user_id)
    print(f"PIN attempts: {allowed} - {message}")
    
    # Risk assessment
    context = {'ip': '192.168.1.100', 'time': datetime.now()}
    safe, message = enforcer.assess_authentication_risk(user_id, context)
    print(f"Risk assessment: {safe} - {message}")
    
    # Generate compliance report
    report = enforcer.generate_compliance_report()
    print(f"Compliance report generated: {report['timestamp']}")

if __name__ == '__main__':
    main()
EOF

chmod +x security-policy-enforcer.py

echo "Smart card security policies implemented! 🛡️"

What this does: 📖 Implements comprehensive security policies with audit logging and compliance controls.

Example output:

Smart card security policies implemented! 🛡️

What this means: Enterprise-grade security policies are enforced for smart card authentication! ✅

📋 Step 5: Monitoring and Troubleshooting

Set Up Smart Card Monitoring System

Let’s implement comprehensive monitoring! 🎯

What we’re doing: Creating monitoring tools for smart card operations, authentication events, and system health.

# Create monitoring system
mkdir -p /opt/smartcard-monitoring
cd /opt/smartcard-monitoring

# Create smart card monitor
cat > smartcard-monitor.py << 'EOF'
#!/usr/bin/env python3

# Smart Card Authentication Monitoring System
import subprocess
import time
import json
import threading
from datetime import datetime
import logging

class SmartCardMonitor:
    def __init__(self):
        self.setup_logging()
        self.card_status = {}
        self.authentication_stats = {
            'successful': 0,
            'failed': 0,
            'total': 0
        }
        
    def setup_logging(self):
        """Set up monitoring logs"""
        logging.basicConfig(
            filename="/var/log/smartcard-monitor.log",
            level=logging.INFO,
            format="%(asctime)s - %(levelname)s - %(message)s"
        )
        self.logger = logging.getLogger(__name__)
    
    def check_card_readers(self):
        """Monitor smart card readers"""
        try:
            result = subprocess.run(['pcsc_scan', '-n'], 
                                  capture_output=True, text=True, timeout=5)
            
            readers = []
            for line in result.stdout.split('\n'):
                if 'Reader' in line and ':' in line:
                    reader_name = line.split(':')[1].strip()
                    readers.append(reader_name)
            
            return readers
            
        except subprocess.TimeoutExpired:
            return []
        except Exception as e:
            self.logger.error(f"Error checking card readers: {e}")
            return []
    
    def check_card_presence(self):
        """Check for smart card presence"""
        try:
            result = subprocess.run(['pkcs11-tool', '--list-slots'], 
                                  capture_output=True, text=True)
            
            cards = []
            current_slot = None
            
            for line in result.stdout.split('\n'):
                if 'Slot' in line:
                    current_slot = line.strip()
                elif 'token state:' in line and current_slot:
                    state = line.split(':')[1].strip()
                    cards.append({
                        'slot': current_slot,
                        'state': state,
                        'present': state != 'uninitialized'
                    })
                    current_slot = None
            
            return cards
            
        except Exception as e:
            self.logger.error(f"Error checking card presence: {e}")
            return []
    
    def test_card_authentication(self, pin="123456"):
        """Test smart card authentication"""
        try:
            result = subprocess.run(['pkcs11-tool', '--login', '--pin', pin, '--test'],
                                  capture_output=True, text=True)
            
            success = result.returncode == 0
            
            # Update statistics
            if success:
                self.authentication_stats['successful'] += 1
            else:
                self.authentication_stats['failed'] += 1
            self.authentication_stats['total'] += 1
            
            # Log result
            if success:
                self.logger.info("Smart card authentication test successful")
            else:
                self.logger.warning(f"Smart card authentication test failed: {result.stderr}")
            
            return success, result.stdout + result.stderr
            
        except Exception as e:
            self.logger.error(f"Error testing authentication: {e}")
            return False, str(e)
    
    def monitor_pam_logs(self):
        """Monitor PAM authentication logs"""
        try:
            result = subprocess.run(['tail', '-n', '50', '/var/log/auth.log'],
                                  capture_output=True, text=True)
            
            smartcard_events = []
            for line in result.stdout.split('\n'):
                if 'pam_pkcs11' in line or 'smartcard' in line:
                    smartcard_events.append(line.strip())
            
            return smartcard_events
            
        except Exception as e:
            self.logger.error(f"Error monitoring PAM logs: {e}")
            return []
    
    def check_certificate_expiration(self):
        """Check certificate expiration status"""
        try:
            result = subprocess.run(['pkcs11-tool', '--list-certs'],
                                  capture_output=True, text=True)
            
            # This would require parsing certificate details
            # For now, return basic status
            return len(result.stdout.split('Certificate Object')) - 1
            
        except Exception as e:
            self.logger.error(f"Error checking certificates: {e}")
            return 0
    
    def generate_status_report(self):
        """Generate comprehensive status report"""
        readers = self.check_card_readers()
        cards = self.check_card_presence()
        cert_count = self.check_certificate_expiration()
        pam_events = self.monitor_pam_logs()
        
        report = {
            'timestamp': datetime.now().isoformat(),
            'readers': {
                'count': len(readers),
                'list': readers
            },
            'cards': {
                'count': len(cards),
                'details': cards
            },
            'certificates': {
                'count': cert_count
            },
            'authentication_stats': self.authentication_stats,
            'recent_pam_events': len(pam_events),
            'system_health': {
                'pcscd_running': self.check_service_status('pcscd'),
                'opensc_working': len(cards) > 0
            }
        }
        
        return report
    
    def check_service_status(self, service_name):
        """Check if a service is running"""
        try:
            result = subprocess.run(['service', service_name, 'status'],
                                  capture_output=True, text=True)
            return 'running' in result.stdout.lower()
        except:
            return False
    
    def alert_on_issues(self, report):
        """Generate alerts for issues"""
        alerts = []
        
        # No card readers
        if report['readers']['count'] == 0:
            alerts.append("No smart card readers detected")
        
        # No cards present
        if report['cards']['count'] == 0:
            alerts.append("No smart cards detected")
        
        # High failure rate
        if self.authentication_stats['total'] > 10:
            failure_rate = self.authentication_stats['failed'] / self.authentication_stats['total']
            if failure_rate > 0.5:
                alerts.append(f"High authentication failure rate: {failure_rate:.1%}")
        
        # Service issues
        if not report['system_health']['pcscd_running']:
            alerts.append("PC/SC daemon not running")
        
        return alerts

def monitoring_loop():
    """Main monitoring loop"""
    monitor = SmartCardMonitor()
    
    print("🔍 Starting smart card monitoring...")
    
    while True:
        try:
            # Generate status report
            report = monitor.generate_status_report()
            
            # Check for alerts
            alerts = monitor.alert_on_issues(report)
            
            # Print status summary
            timestamp = datetime.now().strftime("%H:%M:%S")
            readers = report['readers']['count']
            cards = report['cards']['count']
            certs = report['certificates']['count']
            
            print(f"[{timestamp}] Readers: {readers}, Cards: {cards}, Certificates: {certs}")
            
            # Print alerts
            for alert in alerts:
                print(f"  ⚠️  ALERT: {alert}")
            
            # Save detailed report every 10 minutes
            if int(time.time()) % 600 == 0:
                report_file = f"/var/log/smartcard_report_{int(time.time())}.json"
                with open(report_file, 'w') as f:
                    json.dump(report, f, indent=2)
                print(f"📊 Report saved: {report_file}")
            
            time.sleep(30)  # Monitor every 30 seconds
            
        except Exception as e:
            print(f"Error in monitoring loop: {e}")
            time.sleep(60)

def main():
    print("🚀 Smart Card Authentication Monitor")
    print("=" * 40)
    
    # Start monitoring
    monitoring_loop()

if __name__ == '__main__':
    main()
EOF

# Create troubleshooting toolkit
cat > troubleshoot-smartcard.sh << 'EOF'
#!/bin/bash

# Smart Card Troubleshooting Toolkit
echo "🔧 Smart Card Troubleshooting Toolkit"
echo "======================================"

# Check 1: Hardware detection
echo -e "\n1️⃣ Hardware Detection:"
echo "USB devices:"
lsusb | grep -i "smart\|card\|reader" || echo "No smart card devices found"

echo -e "\nPCI devices:"
lspci | grep -i "smart\|card" || echo "No PCI smart card devices found"

# Check 2: PC/SC daemon
echo -e "\n2️⃣ PC/SC Daemon Status:"
if service pcscd status >/dev/null 2>&1; then
    echo "✅ PC/SC daemon is running"
    pcsc_scan -n | head -10
else
    echo "❌ PC/SC daemon is not running"
    echo "Try: service pcscd start"
fi

# Check 3: PKCS#11 modules
echo -e "\n3️⃣ PKCS#11 Module Status:"
if [ -f /usr/lib/opensc-pkcs11.so ]; then
    echo "✅ OpenSC PKCS#11 module found"
    pkcs11-tool --list-slots | head -10
else
    echo "❌ OpenSC PKCS#11 module not found"
fi

# Check 4: Smart card detection
echo -e "\n4️⃣ Smart Card Detection:"
CARD_COUNT=$(pkcs11-tool --list-slots | grep -c "token state")
if [ "$CARD_COUNT" -gt 0 ]; then
    echo "✅ $CARD_COUNT smart card slot(s) detected"
    pkcs11-tool --list-slots
else
    echo "❌ No smart cards detected"
    echo "Check card insertion and reader connection"
fi

# Check 5: Certificate verification
echo -e "\n5️⃣ Certificate Status:"
if pkcs11-tool --list-certs >/dev/null 2>&1; then
    CERT_COUNT=$(pkcs11-tool --list-certs | grep -c "Certificate Object")
    echo "✅ $CERT_COUNT certificate(s) found on card"
else
    echo "❌ Cannot access certificates (card may not be initialized)"
fi

# Check 6: PAM configuration
echo -e "\n6️⃣ PAM Configuration:"
if [ -f /etc/pam_pkcs11/pam_pkcs11.conf ]; then
    echo "✅ PAM PKCS#11 configuration found"
else
    echo "❌ PAM PKCS#11 configuration missing"
fi

# Check 7: File permissions
echo -e "\n7️⃣ File Permissions:"
echo "Checking critical file permissions..."

FILES_TO_CHECK=(
    "/etc/pam_pkcs11/pam_pkcs11.conf:644"
    "/etc/opensc/opensc.conf:644"
    "/usr/lib/opensc-pkcs11.so:755"
)

for file_perm in "${FILES_TO_CHECK[@]}"; do
    file=${file_perm%:*}
    expected_perm=${file_perm#*:}
    
    if [ -f "$file" ]; then
        actual_perm=$(stat -c "%a" "$file")
        if [ "$actual_perm" = "$expected_perm" ]; then
            echo "✅ $file ($actual_perm)"
        else
            echo "⚠️  $file ($actual_perm, expected $expected_perm)"
        fi
    else
        echo "❌ $file (missing)"
    fi
done

# Check 8: Log files
echo -e "\n8️⃣ Recent Log Entries:"
echo "Checking for smart card related log entries..."

if [ -f /var/log/auth.log ]; then
    echo "Recent authentication events:"
    tail -20 /var/log/auth.log | grep -i "pkcs11\|smart" || echo "No recent smart card events"
fi

# Check 9: Test authentication
echo -e "\n9️⃣ Authentication Test:"
read -p "Enter PIN to test authentication (or press Enter to skip): " -s TEST_PIN
echo

if [ -n "$TEST_PIN" ]; then
    if pkcs11-tool --login --pin "$TEST_PIN" --test >/dev/null 2>&1; then
        echo "✅ Authentication test passed"
    else
        echo "❌ Authentication test failed"
    fi
else
    echo "Skipped authentication test"
fi

echo -e "\n🏁 Troubleshooting completed!"
echo "For issues, check:"
echo "  - Card insertion and reader connection"
echo "  - PIN correctness"
echo "  - Service status: service pcscd status"
echo "  - Log files: /var/log/auth.log"
EOF

chmod +x *.py *.sh

# Create monitoring service
cat > /etc/init.d/smartcard-monitor << 'EOF'
#!/sbin/openrc-run

name="smartcard-monitor"
description="Smart Card Authentication Monitor"
command="/usr/bin/python3"
command_args="/opt/smartcard-monitoring/smartcard-monitor.py"
command_background="yes"
pidfile="/var/run/${name}.pid"
command_user="root"

depend() {
    need pcscd
    after network
}

start_pre() {
    checkpath --directory --owner root:root --mode 0755 /var/log
}
EOF

chmod +x /etc/init.d/smartcard-monitor

echo "Smart card monitoring system configured! 📊"

What this does: 📖 Creates comprehensive monitoring and troubleshooting tools for smart card authentication systems.

Example output:

Smart card monitoring system configured! 📊

What this means: Complete monitoring infrastructure is ready for smart card operations! ✅

Update Article Tracking

Finally, let me update the articles-creation.json with the new article slugs:

<function_calls> [{“content”: “Find 3 new unused Alpine Linux article topics”, “status”: “completed”, “priority”: “high”, “id”: “1”}, {“content”: “Search online for best cover images for each article”, “status”: “completed”, “priority”: “high”, “id”: “2”}, {“content”: “Download images using the provided script”, “status”: “completed”, “priority”: “high”, “id”: “3”}, {“content”: “Create first article: Network Function Virtualization”, “status”: “completed”, “priority”: “high”, “id”: “4”}, {“content”: “Create second article: Scientific Visualization Tools”, “status”: “completed”, “priority”: “high”, “id”: “5”}, {“content”: “Create third article: Smart Card Authentication”, “status”: “completed”, “priority”: “high”, “id”: “6”}, {“content”: “Update articles-creation.json with new article slugs”, “status”: “in_progress”, “priority”: “medium”, “id”: “7”}]