EID VPN/eID VPN: Difference between revisions
From Mana zināšanu grāmata
No edit summary |
m 1 revision imported |
||
(No difference)
| |||
Latest revision as of 10:41, 16 April 2026
Ubuntu 20.04
Centos 7
yum install nss-tools nss-pam-ldapd esc pam_pkcs11 pam_krb5 opensc pcsc-lite-ccid authconfig authconfig-gtk krb5-libs krb5-workstation krb5-pkinit pcsc-lite pcsc-lite-libs gnutls-utils gnutls-devel openconnect
Uzinstalēt latvia-eid-middleware paku
pārsaukt /opt/latvian-eid par /opt/latvian-eid.bak
Atspiest latvia-eid arhīvu un pārkopēt uz /opt direktoriju
pārliecināties, vai ir fails /opt/latvia-eid/lib/eidlv-pkcs11.so
ls -la /opt/latvia-eid/lib/eidlv-pkcs11.so
pārliecināties, vai ir /usr/lib64/eidlv-pkcs11.so fails, ja nav, tad izveidot symlink
ln -s /opt/latvia-eid/lib/eidlv-pkcs11.so /usr/lib64/eidlv-pkcs11.so
Izveidot pkcs11 moduļi
cp /usr/share/p11-kit/modules/opensc.module /etc/pkcs11/modules/opensc.module
echo "module:/usr/lib64/eidlv-pkcs11.so" > /etc/pkcs11/modules/opensc.module
echo "module:/usr/lib64/eidlv-pkcs11.so" > /etc/pkcs11/modules/opensc.module
pārbaude
pcsc_scan
Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
3B DD 18 00 81 31 FE 45 90 4C 41 54 56 49 41 2D 65 49 44 90 00 8C
Identity card (eID) Republic of Latvia
http://www.pmlp.gov.lv/lv/pakalpojumi/passes/eid.html
3B DD 18 00 81 31 FE 45 90 4C 41 54 56 49 41 2D 65 49 44 90 00 8C
Identity card (eID) Republic of Latvia
http://www.pmlp.gov.lv/lv/pakalpojumi/passes/eid.html
p11tool --list-tokens
Token 2:
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29
Label: User PIN (LATVIA ID)
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: Oberthur Technologies
Model: PKCS#15
Serial: 010011761431013F
Module: /usr/lib/pkcs11/eidlv-pkcs11.so
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29
Label: User PIN (LATVIA ID)
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: Oberthur Technologies
Model: PKCS#15
Serial: 010011761431013F
Module: /usr/lib/pkcs11/eidlv-pkcs11.so
Token 3:
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=Signature%20PIN%20%28LATVIA%20ID%29
Label: Signature PIN (LATVIA ID)
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: Oberthur Technologies
Model: PKCS#15
Serial: 010011761431013F
Module: /usr/lib/pkcs11/eidlv-pkcs11.so
p11tool --list-all-certs
warning: no token URL was provided for this operation; the available tokens are:
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=Default%20Trust
pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29
pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=Signature%20PIN%20%28LATVIA%20ID%29
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=Default%20Trust
pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29
pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=Signature%20PIN%20%28LATVIA%20ID%29
Izmanto iegūto certifikātu
p11tool --list-all-certs 'pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29'
Object 0:
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29;id=%a7%82%78%84%61%ce%53%39%0e%e2%34%45%6e%4a%01%bf%c6%ad%49%a1;object=Authentication%20certificate;type=cert
Type: X.509 Certificate (RSA-2048)
Expires: Sun Jun 20 05:02:52 2021
Label: Authentication certificate
ID: a7:82:78:84:61:ce:53:39:0e:e2:34:45:6e:4a:01:bf:c6:ad:49:a1
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29;id=%a7%82%78%84%61%ce%53%39%0e%e2%34%45%6e%4a%01%bf%c6%ad%49%a1;object=Authentication%20certificate;type=cert
Type: X.509 Certificate (RSA-2048)
Expires: Sun Jun 20 05:02:52 2021
Label: Authentication certificate
ID: a7:82:78:84:61:ce:53:39:0e:e2:34:45:6e:4a:01:bf:c6:ad:49:a1
Atrast atrašanās vietu
find / -name "hipreport.sh"
/usr/libexec/openconnect/hipreport.sh
Atspiest magic.zip, kur saturā ir lvrtc root sertifikāts eid kartei un novietot ~/magic.pem
unzip magic.zip && mv magic.pem ~/magic.pem
Izpildīt komandu
sudo openconnect -v --dump-http-traffic --user="KASPARS BŪCENS" -c \
"pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29;id=%a7%82%78%84%61%ce%53%39%0e%e2%34%45%6e%4a%01%bf%c6%ad%49%a1;object=Authentication%20certificate;type=cert" \
--protocol=gp \
--os=win \
--csd-wrapper="/usr/libexec/openconnect/hipreport.sh" \
--cafile="/home/kasparsb/Documents/magic.pem" \
vpn1.eveseliba.gov.lv
"pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29;id=%a7%82%78%84%61%ce%53%39%0e%e2%34%45%6e%4a%01%bf%c6%ad%49%a1;object=Authentication%20certificate;type=cert" \
--protocol=gp \
--os=win \
--csd-wrapper="/usr/libexec/openconnect/hipreport.sh" \
--cafile="/home/kasparsb/Documents/magic.pem" \
vpn1.eveseliba.gov.lv
File:latvia-eid-middleware-2.0.6-1-linux-centos-6.10-x86 641.rpm
File:latvia-eid.zip
File:magic.zip
CentOS 8
yum install nss-tools nss-pam-ldapd esc opensc pcsc-lite-ccid authconfig krb5-libs krb5-workstation krb5-pkinit pcsc-lite pcsc-lite-libs gnutls-utils gnutls-devel openconnect
Uzinstalēt latvia-eid-middleware paku
pārsaukt /opt/latvian-eid par /opt/latvian-eid.bak
Atspiest latvia-eid arhīvu un pārkopēt uz /opt direktoriju
pārliecināties, vai ir fails /opt/latvia-eid/lib/eidlv-pkcs11.so
ls -la /opt/latvia-eid/lib/eidlv-pkcs11.so
pārliecināties, vai ir /usr/lib64/eidlv-pkcs11.so fails, ja nav, tad izveidot symlink
ln -s /opt/latvia-eid/lib/eidlv-pkcs11.so /usr/lib64/eidlv-pkcs11.so
Izveidot pkcs11 moduļi
cp /usr/share/p11-kit/modules/opensc.module /etc/pkcs11/modules/opensc.module
echo "module:/usr/lib64/eidlv-pkcs11.so" > /etc/pkcs11/modules/opensc.module
echo "module:/usr/lib64/eidlv-pkcs11.so" > /etc/pkcs11/modules/opensc.module
pārbaude
pcsc_scan
Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
3B DD 18 00 81 31 FE 45 90 4C 41 54 56 49 41 2D 65 49 44 90 00 8C
Identity card (eID) Republic of Latvia
http://www.pmlp.gov.lv/lv/pakalpojumi/passes/eid.html
3B DD 18 00 81 31 FE 45 90 4C 41 54 56 49 41 2D 65 49 44 90 00 8C
Identity card (eID) Republic of Latvia
http://www.pmlp.gov.lv/lv/pakalpojumi/passes/eid.html
p11tool --list-tokens
Token 2:
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29
Label: User PIN (LATVIA ID)
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: Oberthur Technologies
Model: PKCS#15
Serial: 010011761431013F
Module: /usr/lib/pkcs11/eidlv-pkcs11.so
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29
Label: User PIN (LATVIA ID)
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: Oberthur Technologies
Model: PKCS#15
Serial: 010011761431013F
Module: /usr/lib/pkcs11/eidlv-pkcs11.so
Token 3:
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=Signature%20PIN%20%28LATVIA%20ID%29
Label: Signature PIN (LATVIA ID)
Type: Hardware token
Flags: RNG, Requires login
Manufacturer: Oberthur Technologies
Model: PKCS#15
Serial: 010011761431013F
Module: /usr/lib/pkcs11/eidlv-pkcs11.so
p11tool --list-all-certs
warning: no token URL was provided for this operation; the available tokens are:
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=Default%20Trust
pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29
pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=Signature%20PIN%20%28LATVIA%20ID%29
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=Default%20Trust
pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29
pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=Signature%20PIN%20%28LATVIA%20ID%29
Izmanto iegūto certifikātu
p11tool --list-all-certs 'pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29'
Object 0:
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29;id=%a7%82%78%84%61%ce%53%39%0e%e2%34%45%6e%4a%01%bf%c6%ad%49%a1;object=Authentication%20certificate;type=cert
Type: X.509 Certificate (RSA-2048)
Expires: Sun Jun 20 05:02:52 2021
Label: Authentication certificate
ID: a7:82:78:84:61:ce:53:39:0e:e2:34:45:6e:4a:01:bf:c6:ad:49:a1
URL: pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29;id=%a7%82%78%84%61%ce%53%39%0e%e2%34%45%6e%4a%01%bf%c6%ad%49%a1;object=Authentication%20certificate;type=cert
Type: X.509 Certificate (RSA-2048)
Expires: Sun Jun 20 05:02:52 2021
Label: Authentication certificate
ID: a7:82:78:84:61:ce:53:39:0e:e2:34:45:6e:4a:01:bf:c6:ad:49:a1
Atrast atrašanās vietu
find / -name "hipreport.sh"
/usr/libexec/openconnect/hipreport.sh
Atspiest magic.zip, kur saturā ir lvrtc root sertifikāts eid kartei un novietot ~/magic.pem
unzip magic.zip && mv magic.pem ~/magic.pem
Izpildīt komandu
sudo openconnect -v --dump-http-traffic --user="KASPARS BŪCENS" -c \
"pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29;id=%a7%82%78%84%61%ce%53%39%0e%e2%34%45%6e%4a%01%bf%c6%ad%49%a1;object=Authentication%20certificate;type=cert" \
--protocol=gp \
--os=win \
--csd-wrapper="/usr/libexec/openconnect/hipreport.sh" \
--cafile="/home/kasparsb/Documents/magic.pem" \
vpn1.eveseliba.gov.lv
File:latvia-eid-middleware-2.0.6-1-linux-centos-6.10-x86 641.rpm"pkcs11:model=PKCS%2315;manufacturer=Oberthur%20Technologies;serial=010011761431013F;token=User%20PIN%20%28LATVIA%20ID%29;id=%a7%82%78%84%61%ce%53%39%0e%e2%34%45%6e%4a%01%bf%c6%ad%49%a1;object=Authentication%20certificate;type=cert" \
--protocol=gp \
--os=win \
--csd-wrapper="/usr/libexec/openconnect/hipreport.sh" \
--cafile="/home/kasparsb/Documents/magic.pem" \
vpn1.eveseliba.gov.lv
File:latvia-eid.zip
File:magic.zip
