Smart card reader not working in Manjaro 19

Question

I am running Manjaro 19.0.2, and I am struggling to get it to even detect a smart card reader I'm using: the SCR3310v2.0. I need this to work in order to access online US Military resources using a CAC to verify and authenticate my identity. I am using Firefox 75.0 as my browser of choice.

I have already followed all the steps laid out in the DoD Cyber Exchange guide to using CAC for Firefox in Linux. I have also followed MilitaryCAC's guide for Linux users.

The following is a summary of the two guides linked above.

For PKCS#11 implementation, I am using OpenSC. I have also installed the four packages prescribed by MilitaryCAC:

pcsc-lite - PCSC Smart Cards Library
pcsc-ccid* - generic USB CCID (Chip/Smart Card Interface Devices) driver
perl-pcsc - Abstraction layer to smart card readers
pcsc-tools - Optional but highly recommended, these tools are used to test a PCSC driver, card and reader

*exact package name not found in pamac manager; installed ccid instead

I imported to Firefox all credentials located in https://militarycac.com/maccerts/AllCerts.zip (link provided by MilitaryCAC). I loaded a file called opensc-pkcs11.so in Firefox security settings.

After doing all of this work, the smart card reader will not even light up upon connecting it to my PC, which is typical in Windows machines. There is no indication of the hardware being detected in the file explorer, either.

I know there's nothing wrong with the reader itself, as it works just fine in a Windows. I also know it's not because of missing USB drivers, as they are installed with Manjaro from the get-go, or their faulty configurations, as my PC is able to detect and interface with other USB connected hardware, such as my phone.

I am clueless as to what I could try next, save for running Windows in a virtual machine. I would much prefer to have it work in Linux, if possible. Any help is welcome and greatly appreciated.

---

NOTE

I managed to solve this problem. The solution that worked for me is found below. Also note that since this question was posted, my distro version was updated to v20.0

Answer 1

Is the pcscd process running? (Does pgrep -l pcscd output anything?) It should run as a service/daemon, but you might need to enable it first.

sudo systemctl start pcscd.service     # start it now
sudo systemctl enable pcscd.service    # make it start automatically at boot in the future too

The pcsc_scan command should then detect your card reader and give some technical information of your card when inserted.

See also this chain of posts on the Manjaro forum: https://forum.manjaro.org/t/solved-smartcard-reader-not-shown/39460

Basically, poster kubwit's card reader used a custom USB product/vendor ID that needed to be added to /etc/libccid_Info.plist before the ccid driver detected the card. Your card reader should be supported as-is, unless the vendor ID has recently changed (as that card reader is originally from SCR product line, but Identiv bought SCR some time ago).

Answer 2

I managed to solve my problem. Here's how I did it.

1. Using your package manager (in my case, pamac), install the following packages, as detailed in my original post:
   • pcsc-perl
   • pcsc-tools
   • pcsclite
   • ccid
   • opensc
2. Download DoD certificates from this location and extract them.
3. From Firefox, go to Edit > Preferences > Privacy & Security > Certificates > View Certificates > Authorities > Import
4. Find and import the extracted certificates
5. Click on DoD Root CA 2, then Edit Trust and make sure both options are checked*. Once this is done, press OK
6. Click on Security Devices, and then Load. Find and open the file opensc-pkcs11.so. Mine was located in /usr/lib64/opensc-pkcs11.so
7. Open the terminal and run pgrep -l pcscd. As telcoM suggested, you should see an output. If you get nothing, run the two commands in his/her comment to start the pcscd service now and have it run on bootup. pgrep -l pcscd should now output a number followed by pcscd
8. Restart machine
9. Open terminal and run pcsc_scan. The last line in the output should read Waiting for the first reader...
10. Plug in your smart card reader. It should immediately detect it. The terminal should now say Card removed and Card inserted for every time you insert or remove your card, along with all kinds of details regarding the card.
11. You should now be able to access content online requiring authentication with the smart card and its reader.

*I don't know if this is strictly necessary, but that's how mine is set up.

The sources used are:

• MilitaryCAC for Linux Users
• Arch Linux's wiki guide for smart cards
• telcoM's comment response to this post

Answer 3

I was having a bit of an issue on Manjaro, as well. pcsc_scan (after installing everything Manuel listed) was showing that the card is detected correctly, but I could not manage to setup Firefox successfully with the Security device /usr/lib64/opensc-pkcs11.so. When I did so, Firefox would start to freeze up and would not allow me to sign into the module.

From my national eID provider I got a .deb file for download. This file contains the certificates, some executables and the eponymous libEidPkcs11.so.

Once extracted on my filesystem, this .so file could be loaded into Firefox and Firefox allowed me to login with my Identification pin. Also the provided executable files appear to be working correctly on Manjaro.

Finally, I had another minor foible in Libre Office Writer, which was basically my lack of understanding. It turns out that Writer will show current document digital signatures on the digital signatures list and your digital signature options will only show up when you press the Sign document... button. This was a bit counter intuitive for me, but is now straightened out.