{"id":38891,"date":"2019-10-31T22:26:35","date_gmt":"2019-10-31T19:26:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip\/"},"modified":"2019-10-31T22:26:35","modified_gmt":"2019-10-31T19:26:35","slug":"sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","title":{"rendered":"Shared network usage of cryptographic tokens by users based on usbip","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Due to changes in legislation regarding trust services (\"On Electronic Trust Services\" Ukraine), the need arose for several departments to work with keys located on tokens (at the moment, the question of the number of hardware keys is still open).<\/p>\n

As the lowest cost tool (free of charge), the choice immediately fell on usbip<\/a><\/noindex>. The server on Ubuntu 18.04 started working thanks to the publication of Taming USB\/IP<\/a><\/noindex> and was successfully tested on several flash drives (due to the lack of tokens at that time). No significant problems were identified, except for monopolistic ownership (reservation per user) at that moment. It is clear that to organize access for several users (at least two, to start), it is necessary to divide their access in time and make them work in turn.<\/p>\n

The question arose: How to ensure that everyone can work with the least hassle\u2026
\n<\/a><\/noindex><\/p>\n

Brute force approach<\/h1>\n

<\/p>\n

\"Shared
\nOption I<\/b>. Several shortcuts to bat files, namely
\na) Connecting the access key.
\nb) Intentional disconnection. <\/p>\n

Item «b<\/b>» is debatable, so it was decided to allocate 3 minutes for working with the key.<\/p>\n

The peculiarity of the usbip client is that after launching, it hangs in the console, and without interrupting the console session, the connection can be closed \u201cbrutally\u201d from both the client and the server side.<\/p>\n

\n Here is what worked well for us:<\/p>\n

first: connection on.bat<\/i><\/b> <\/p>\n

usbip -a 172.16.12.26 4-1\nmsg * \"Token\/signature unavailable or busy\"<\/code><\/pre>\n
second: disconnection off.bat<\/i><\/b><\/p>\n
ping 127.0.0.1 -n 180\ntaskkill \/IM usbip.exe \/F<\/code><\/pre>\n
\nnot relying on user awareness, the scripts were combined into token.bat<\/i><\/b><\/p>\n
on.bat | off.bat<\/code><\/pre>\n
\nWhat happens: all files are located in one folder, running with the token.bat file. If the connection is closed, the user receives an immediate message about the key's unavailability; otherwise, it only appears after 180 pings. The provided lines of code can be enhanced with «@ECHO OFF» and directing the console to «> nul» to avoid shocking the user too much, but for testing launch, it's not necessary. The initial \"run\" on the USB drive showed that everything is predictably reliable and clear. Moreover, no server-side manipulations are needed.<\/p>\n
\"Shared
\n
\nNaturally, when working directly with the token, things did not go as expected: when physically connected in the device manager, the token registers as 2 devices (WUDF and smart card), while over the network it registers only as WUDF (although this is sufficient for the PIN request).<\/p>\n
\"Shared
\n
\nIt also turned out that the ruthless 'taskkill' is not so harsh, and closing the connection on the client side is problematic, and even if this is achieved, it does not guarantee closure for it on the server.<\/p>\n
Giving up all consoles on the client side, the second script took the form:<\/p>\n
ping 127.0.0.1 -n 180 > nul\ntaskkill \/IM usbip.exe \/F \/T > nul\nping 127.0.0.1 -n 10 > nul\ntaskkill \/IM conhost.exe \/F \/T > nul<\/code><\/pre>\n
\nalthough its effectiveness is less than 50%, since the server stubbornly continued to consider the connection open.<\/p>\n
The connection problems led to thoughts of upgrading the server part.<\/p>\n
Server part<\/h1>\n
\nWhat is needed:<\/p>\n
    \n
  1. Disconnect inactive users from the service.<\/li>\n
  2. See who is currently using (or still occupying) the token.<\/li>\n
  3. See if the token is connected to the computer itself.<\/li>\n<\/ol>\n
    \nThese tasks were decided to be addressed using crontab and apache services. The granularity of the state results monitoring for points 2 and 3 indicates that the file system can be placed on a ramdrive. A line was added in \/etc\/fstab <\/p>\n
    tmpfs   \/ram_drive      tmpfs   defaults,nodev,size=64K         0       0\n<\/code><\/pre>\n
    \nA folder named script was created at the root for scripts: unmounting-mounting token usb_restart.sh <\/p>\n
    usbip unbind -b 1-2\nsleep 2\nusbip bind -b 1-2\nsleep 2\nusbip attach --remote=localhost --busid=1-2\nsleep 2\nusbip detach --port=00<\/code><\/pre>\n
    \nGetting the list of active devices usblist_id.sh<\/p>\n
    usbip list -r 127.0.0.1 | grep ':' | awk -F \":\" '{print $1}' | sed s\/' '\/\/g | grep -v \"^$\" > \/ram_drive\/usb_id.txt<\/code><\/pre>\n
    \nGetting the list of active IPs (with further modifications to display user identifiers) usbip_client_ip.sh<\/p>\n
    netstat -an | grep :3240 | grep ESTABLISHED | awk '{print $5}' | cut -f1 -d\":\" > \/ram_drive\/usb_ip_cli.txt<\/code><\/pre>\n
    \nThe crontab looks like this:<\/p>\n
    * \/5 * * * * \/!script\/usb_restart.sh > \/dev\/null 2>&1\n* * * * * ( sleep 30 ; \/!script\/usblist_id.sh > \/dev\/null)\n* * * * * (sleep 10 ; \/!script\/usbip_client_ip.sh > \/dev\/null)<\/code><\/pre>\n
    \nSo we have: every 5 minutes a new user can connect, regardless of who worked with the token. The folder \/ramdrive is connected to the HTTP server via a symlink, which saves 2 text files indicating the status of the usbip server.<\/p>\n
    Next part: 'Ugly in wrapping'<\/h1>\n
    \nII option.<\/b> To provide users with a somewhat less intimidating interface. Considering that users have different versions of Windows with various frameworks and permissions, a less problematic approach than Lazarus<\/a><\/noindex> I could not find (I'm certainly for C#, but not in this case). You can run bat files from the interface in the background, minimized, but without proper testing, I personally believe: it's necessary to visualize to gather user complaints.<\/p>\n
    \"Shared
    \n
    \nThe interface and software components addressed the following tasks:<\/p>\n
      \n
    1. Displaying whether the token is currently in use.<\/li>\n
    2. On the first launch, initial setup is carried out with the generation of 'correct' bat files that implement starting and stopping the token's session with the server. On subsequent launches, the implementation of 'service' mode via password.<\/li>\n
    3. Checking for connectivity to the server, the results of which determine whether the server is queried about its usage or messages about issues are displayed. Upon resuming connectivity, the program automatically starts working in normal mode.<\/li>\n<\/ol>\n
      \nWorking with the WEB server is implemented using the additional module fphttpclient.<\/p>\n
      \r\n        \"Play\r\n        
      <\/div>\r\n    <\/div><\/center>
      \n      Here will be a link to the current version of the client<\/a><\/noindex><\/p>\n
      There are also further thoughts on the subject of the article, as well as partial initial enthusiasm for the VirtualHere product with its features...
      \n
      Source:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
      \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 ( \u00ab\u041f\u0440\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0441\u043b\u0443\u0433\u0438\u00bb \u0423\u043a\u0440\u0430\u0438\u043d\u0430), \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c \u043e\u0442\u0434\u0435\u043b\u0430\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u043d\u0430 \u0442\u043e\u043a\u0435\u043d\u0430\u0445 (\u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442, \u0432\u043e\u043f\u0440\u043e\u0441 \u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0435\u0449\u0435 \u043e\u0442\u043a\u0440\u044b\u0442). \u041a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0441 \u043d\u0430\u0438\u043c\u0435\u043d\u044c\u0448\u0438\u043c\u0438 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u043c\u0438 (\u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e) \u0441\u0440\u0430\u0437\u0443 \u0432\u044b\u0431\u043e\u0440 \u043f\u0430\u043b \u043d\u0430 usbip. \u0421\u0435\u0440\u0432\u0435\u0440 \u043d\u0430 Ubintu 18.04 \u0437\u0430\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0423\u043a\u0440\u043e\u0449\u0430\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29176,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38891","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Joint network use of cryptographic tokens by users based on usbip | ProHoster","description":"Due to changes in legislation regarding trust services ('On electronic trust services' Ukraine), the enterprise has a need for several departments to work with keys located on.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 usbip | ProHoster","og:description":"\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 ( \u00ab\u041f\u0440\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0441\u043b\u0443\u0433\u0438\u00bb \u0423\u043a\u0440\u0430\u0438\u043d\u0430), \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c \u043e\u0442\u0434\u0435\u043b\u0430\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:26:35+00:00","article:modified_time":"2019-10-31T19:26:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38891","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:51:37","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:00:28","updated":"2026-01-23 23:51:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/38891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=38891"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/38891\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/29176"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=38891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=38891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=38891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}