ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

ืคึผืฉื•ื˜ ืคึผืึทืกื•ื•ืขืจื“ื– ื–ืขื ืขืŸ ื ื™ืฉื˜ ื–ื™ื›ืขืจ, ืื•ืŸ ืงืึธืžืคึผืœืขืงืก ืึธื ืขืก ื–ืขื ืขืŸ ืื•ืžืžืขื’ืœืขืš ืฆื• ื’ืขื“ืขื ืงืขืŸ. ืึทื– ืก ื•ื•ืึธืก ื–ื™ื™ ืึทื–ื•ื™ ืึธืคื˜ ืกื•ืฃ ืึทืจื•ื™ืฃ ืื•ื™ืฃ ืึท ืงืœืขืคึผื™ืง ื˜ืึธืŸ ืื•ื ื˜ืขืจ ื“ื™ ืงืœืึทื•ื•ื™ืึทื˜ื•ืจ ืึธื“ืขืจ ืื•ื™ืฃ ื“ื™ ืžืึธื ื™ื˜ืึธืจ. ืฆื• ืขื ืฉื•ืจ ืึทื– ืคึผืึทืกื•ื•ืขืจื“ื– ื‘ืœื™ื™ื‘ืŸ ืื™ืŸ ื“ื™ ืžื—ืฉื‘ื•ืช ืคื•ืŸ "ืคืขืจื’ืขื˜ืคืึทืœ" ื ื™ืฆืขืจืก ืื•ืŸ ื“ื™ ืจื™ืœื™ื™ืึทื‘ื™ืœืึทื˜ื™ ืคื•ืŸ ืฉื•ืฅ ืื™ื– ื ื™ืฉื˜ ืคืึทืจืคืึทืœืŸ, ืขืก ืื™ื– ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ (2FA).

ืจืขื›ื˜ ืฆื• ื“ืขืจ ืงืึธืžื‘ื™ื ืึทืฆื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹ืึธื•ื ื™ื ื’ ืึท ืžื™ื˜ืœ ืื•ืŸ ื•ื•ื™ืกืŸ ื–ื™ื™ืŸ PIN, ื“ื™ PIN ื–ื™ืš ืงืขื ืขืŸ ื–ื™ื™ืŸ ืกื™ืžืคึผืœืขืจ ืื•ืŸ ื’ืจื™ื ื’ืขืจ ืฆื• ื’ืขื“ืขื ืงืขืŸ. ื“ื™ืกืึทื“ื•ื•ืึทื ื˜ื™ื“ื–ืฉื™ื– ืื™ืŸ PIN ืœืขื ื’ ืึธื“ืขืจ ืจืึทื ื“ืึทืžื ืึทืก ื–ืขื ืขืŸ ืึธืคืกืขื˜ ื“ื•ืจืš ื“ื™ ื’ืฉืžื™ื•ืช ืคืึทืจืžืขื’ืŸ ืคืึธื“ืขืจื•ื ื’ ืื•ืŸ ืจื™ืกื˜ืจื™ืงืฉืึทื ื– ืื•ื™ืฃ PIN ื‘ืจื•ื˜ ืงืจืึทืคื˜.

ืื™ืŸ ื“ืขืจืฆื•, ืขืก ื›ืึทืคึผืึทื ื– ืื™ืŸ ืจืขื’ื™ืจื•ื ื’ ื™ื™ื“ื–ืฉืึทื ืกื™ื– ืึทื– ื–ื™ื™ ื•ื•ืขืœืŸ ืึทืœืฅ ืฆื• ืึทืจื‘ืขื˜ืŸ ืœื•ื™ื˜ GOST. ื“ื™ 2FA ืึธืคึผืฆื™ืข ืคึฟืึทืจ ืœืึธื’ื™ื ื’ ืื™ืŸ ืœื™ื ื•ืงืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ื“ื™ืกืงืึทืกื˜. ืื™ืš ืฐืขืœ ืึธื ื”ื™ื™ื‘ืŸ ืคึฟื•ืŸ ื“ืขืจ ืฐืฒึทื˜ืŸ.

PAM ืžืึทื“ื–ืฉื•ืœื–

ืคึผืœืึทื’ืึทื‘ืœืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืžืึธื“ื•ืœืขืก (PAM) ื–ืขื ืขืŸ ืžืึทื“ื–ืฉื•ืœื– ืžื™ื˜ ืึท ื ืึธืจืžืึทืœ ืึทืคึผื™ ืื•ืŸ ื™ืžืคึผืœืึทืžืึทื ืฅ ืคื•ืŸ ืคืึทืจืฉื™ื“ืŸ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืžืขืงืึทื ื™ื–ืึทืžื– ืื™ืŸ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–.
ื›ืœ ื™ื•ื˜ื™ืœืึทื˜ื™ื– ืื•ืŸ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– ื•ื•ืึธืก ืงืขื ืขืŸ ืึทืจื‘ืขื˜ืŸ ืžื™ื˜ PAM ืงืœื™ื™ึทื‘ืŸ ื–ื™ื™ ืื•ืŸ ืงืขื ืขืŸ ื ื•ืฆืŸ ื–ื™ื™ ืคึฟืึทืจ ื‘ืึทื ื™ืฆืขืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ.
ืื™ืŸ ืคื™ืจ, ืขืก ืึทืจื‘ืขื˜ ืขืคึผืขืก ื•ื•ื™ ื“ืึธืก: ื“ื™ ืœืึธื’ื™ืŸ ื‘ืึทืคึฟืขืœ ืจื•ืคื˜ PAM, ื•ื•ืึธืก ืคึผืขืจืคืึธืจืžื– ืึทืœืข ื“ื™ ื ื™ื™ื˜ื™ืง ื˜ืฉืขืงืก ื ื™ืฆืŸ ื“ื™ ืžืึทื“ื–ืฉื•ืœื– ืกืคึผืขืกื™ืคื™ืขื“ ืื™ืŸ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข ืื•ืŸ ืงืขืจื˜ ื“ื™ ืจืขื–ื•ืœื˜ืึทื˜ ืฆื•ืจื™ืง ืฆื• ื“ื™ ืœืึธื’ื™ืŸ ื‘ืึทืคึฟืขืœ.

librtpam

ื“ืขืจ ืžืึธื“ื•ืœืข ื“ืขื•ื•ืขืœืึธืคึผืขื“ ื“ื•ืจืš ื“ื™ ืึทืงื˜ื™ื•ื• ืคื™ืจืžืข ืžื•ืกื™ืฃ ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืคื•ืŸ ื ื™ืฆืขืจืก ื ื™ืฆืŸ ืกืžืึทืจื˜ ืงืึทืจื“ืก ืึธื“ืขืจ ื•ืกื‘ ื˜ืึธืงืขื ืก ื ื™ืฆืŸ ืึทืกื™ืžืžืขื˜ืจื™ืง ืฉืœื™ืกืœืขืŸ ืœื•ื™ื˜ ื“ื™ ืœืขืฆื˜ืข ืกื˜ืึทื ื“ืึทืจื“ืก ืคื•ืŸ ื“ื™ื ืขืจ ืงืจื™ืคึผื˜ืึธื’ืจืึทืคื™.

ื–ืืœ ืก ืงื•ืง ืื™ืŸ ื“ืขื ืคึผืจื™ื ืฆื™ืคึผ ืคื•ืŸ ื–ื™ื™ึทืŸ ืึธืคึผืขืจืึทืฆื™ืข:

  • ื“ืขืจ ืกื™ืžืขืŸ ืกื˜ืึธืจื– ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืก ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื•ืŸ ื–ื™ื™ืŸ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ;
  • ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ื– ื’ืขืจืื˜ืขื•ื•ืขื˜ ืื™ืŸ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ 'ืก ื”ื™ื™ื ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ื•ื•ื™ ื˜ืจืึทืกื˜ื™ื“.

ื“ืขืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืคึผืจืึธืฆืขืก ืึทืงืขืจื– ื•ื•ื™ ื’ื™ื™ื˜:

  1. Rutoken ื–ื•ื›ื˜ ืคึฟืึทืจ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืก ืคึผืขืจื–ืขื ืœืขืš ื‘ืึทื•ื•ื™ื™ึทื–ืŸ.
  2. ื“ื™ ืกื™ืžืขืŸ PIN ืื™ื– ืคืืจืœืื ื’ื˜.
  3. ื˜ืจืึทืค ื“ืึทื˜ืŸ ืื™ื– ื’ืขื—ืชืžืขื˜ ืื•ื™ืฃ ื“ื™ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ ื’ืœื™ื™ึทืš ืื™ืŸ ื“ื™ Rutoken ืฉืคึผืึธืŸ.
  4. ื“ื™ ืจื™ื–ืึทืœื˜ื™ื ื’ ื›ืกื™ืžืข ืื™ื– ื•ื•ืขืจืึทืคื™ื™ื“ ื ื™ืฆืŸ ื“ื™ ืฆื™ื‘ื•ืจ ืฉืœื™ืกืœ ืคื•ืŸ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืก ื‘ืึทื•ื•ื™ื™ึทื–ืŸ.
  5. ื“ืขืจ ืžืึธื“ื•ืœืข ืงืขืจื˜ ื“ื™ ื›ืกื™ืžืข ื•ื•ืขืจืึทืคืึทืงื™ื™ืฉืึทืŸ ืจืขื–ื•ืœื˜ืึทื˜ ืฆื• ื“ื™ ืคืึทืš ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ.

ืื™ืจ ืงืขื ืขืŸ ืึธื˜ืขื ื˜ืึทืงื™ื™ื˜ ื ื™ืฆืŸ GOST R 34.10-2012 ืฉืœื™ืกืœืขืŸ (ืœืขื ื’ 256 ืึธื“ืขืจ 512 ื‘ื™ืฅ) ืึธื“ืขืจ ื“ื™ ืึทื•ื˜ื“ื™ื™ื˜ื™ื“ GOST R 34.10-2001.

ืื™ืจ ื˜ืึธืŸ ื ื™ื˜ ื”ืึธื‘ืŸ ืฆื• ื–ืึธืจื’ ื•ื•ืขื’ืŸ ื“ื™ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืคื•ืŸ ื“ื™ ืฉืœื™ืกืœืขืŸ - ื–ื™ื™ ื–ืขื ืขืŸ ื“ื–ืฉืขื ืขืจื™ื™ื˜ืึทื“ ื’ืœื™ื™ึทืš ืื™ืŸ Rutoken ืื•ืŸ ืงื™ื™ื ืžืึธืœ ืœืึธื–ืŸ ื–ื™ื™ืŸ ื–ื›ึผืจื•ืŸ ื‘ืขืฉืึทืก ืงืจื™ืคึผื˜ืึธื’ืจืึทืคื™ืง ืึทืคึผืขืจื™ื™ืฉืึทื ื–.

ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

Rutoken EDS 2.0 ืื™ื– ืกืขืจื˜ืึทืคื™ื™ื“ ื“ื•ืจืš ื“ื™ ืคืกื‘ ืื•ืŸ FSTEC ืœื•ื™ื˜ NDV 4, ื“ืขืจื™ื‘ืขืจ ืขืก ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ืื™ืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืกื™ืกื˜ืขืžืขืŸ ื•ื•ืึธืก ืคึผืจืึทืกืขืก ืงืึทื ืคืึทื“ืขื ืฉืึทืœ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข.

ืคึผืจืึทืงื˜ื™ืฉ ื ื•ืฆืŸ

ื›ึผืžืขื˜ ืงื™ื™ืŸ ืžืึธื“ืขืจืŸ ืœื™ื ื•ืงืก ื•ื•ืขื˜ ื˜ืึธืŸ, ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ ืžื™ืจ ื•ื•ืขืœืŸ ื ื•ืฆืŸ xUbuntu 18.10.

1) ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ื™ ื ื™ื™ื˜ื™ืง ืคึผืึทืงืึทื“ื–ืฉืึทื–

sudo apt-get install libccid pcscd opensc
ืื•ื™ื‘ ืื™ืจ ื•ื•ื™ืœืŸ ืฆื• ืœื™ื™ื’ืŸ ืึท ื“ืขืกืงื˜ืึทืคึผ ืฉืœืึธืก ืžื™ื˜ ืึท ืกืงืจืขืขื ืกืึทื•ื•ืขืจ, ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ืขื ืคึผืขืงืœ ืึทื“ื™ืฉื ืึทืœื™ libpam-pkcs11.

2) ืœื™ื™ื’ ืึท PAM ืžืึธื“ื•ืœืข ืžื™ื˜ GOST ืฉื˜ื™ืฆืŸ

ืœืึธื•ื“ื™ื ื’ ื“ื™ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ืคึฟื•ืŸ https://download.rutoken.ru/Rutoken/PAM/
ื ืึธื›ืžืึทื›ืŸ ื“ื™ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ PAM ื˜ืขืงืข librtpam.so.1.0.0 ืฆื• ื“ื™ ืกื™ืกื˜ืขื ื˜ืขืงืข
/usr/lib/ ืึธื“ืขืจ /usr/lib/x86_64-linux-gnu/ืึธื“ืขืจ /usr/lib64

3) ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ืขื ืคึผืขืงืœ ืžื™ื˜ librtpkcs11ecp.so

ืืจืืคืงืืคื™ืข ืื•ืŸ ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ื™ DEB ืึธื“ืขืจ RPM ืคึผืขืงืœ ืคึฟื•ืŸ ื“ืขื ืœื™ื ืง: https://www.rutoken.ru/support/download/pkcs/

4) ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืึทื– Rutoken EDS 2.0 ืึทืจื‘ืขื˜ ืื™ืŸ ื“ื™ ืกื™ืกื˜ืขื

ืื™ืŸ ื“ื™ ื•ื•ืึธืงื–ืึทืœ ืžื™ืจ ื•ื™ืกืคื™ืจืŸ
$ pkcs11-tool --module /usr/lib/librtpkcs11ecp.so -T
ืื•ื™ื‘ ืื™ืจ ื–ืขืŸ ื“ื™ ืฉื•ืจื” Rutoken ECP <no label> - ืขืก ืžื™ื˜ืœ ืึทื– ืึทืœืฅ ืื™ื– ื’ื•ื˜.

5) ืœื™ื™ืขื ืขืŸ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ

ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืึทื– ื“ื™ ืžื™ื˜ืœ ื”ืื˜ ืึท ื‘ืึทื•ื•ื™ื™ึทื–ืŸ
$ pkcs11-tool --module /usr/lib/librtpkcs11ecp.so -O
ืื•ื™ื‘ ื ืึธืš ื“ื™ ืฉื•ืจื”:
Using slot 0 with a present token (0x0)

  • ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืื™ื– ื’ืขื•ื•ื™ื–ืŸ ื•ื•ืขื’ืŸ ืฉืœื™ืกืœืขืŸ ืื•ืŸ ืกืขืจื˜ื™ืคื™ืงืึทืฅ, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืœื™ื™ืขื ืขืŸ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื•ืŸ ืจืึทื˜ืขื•ื•ืขืŸ ืขืก ืื•ื™ืฃ ื“ื™ืกืง. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืœื•ื™ืคืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ื‘ืึทืคึฟืขืœ, ืึทื ืฉื˜ืึธื˜ ืคื•ืŸ {ื™ื“} ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืคืึทืจื‘ื™ื™ึทื˜ืŸ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืฉื™ื™ึทืŸ ื•ื•ืึธืก ืื™ืจ ื”ืึธื˜ ื’ืขื–ืขืŸ ืื™ืŸ ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜ ืคื•ืŸ ื“ื™ ืคืจื™ืขืจื“ื™ืงืข ื‘ืึทืคึฟืขืœ:
    $ pkcs11-tool --module /usr/lib/librtpkcs11ecp.so -r -y cert --id {id} --output-file cert.crt
    ืื•ื™ื‘ ื“ื™ cert.crt ื˜ืขืงืข ืื™ื– ื‘ืืฉืืคืŸ, ื’ื™ื™ื  ื•ื•ื™ื™ึทื˜ืขืจ ืฆื• ืฉืจื™ื˜ 6).
  • ืขืก ืื™ื– ื’ืืจื ื™ืฉื˜ ื“ื, ื“ืขืžืึธืœื˜ ื“ืขืจ ืžื™ื˜ืœ ืื™ื– ืœื™ื™ื“ื™ืง. ืงืึธื ื˜ืึทืงื˜ ื“ื™ื™ืŸ ืึทื“ืžื™ื ื™ืกื˜ืจืึทื˜ืึธืจ ืึธื“ืขืจ ืฉืึทืคึฟืŸ ื“ื™ ืฉืœื™ืกืœืขืŸ ืื•ืŸ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ื–ื™ืš ื“ื•ืจืš ื“ื™ ื•ื•ื™ื™ึทื˜ืขืจ ืฉืจื™ื˜.

5.1) ืฉืึทืคึฟืŸ ืึท ืคึผืจืึธื‘ืข ื‘ืึทื•ื•ื™ื™ึทื–ืŸ

ื•ืคืžืขืจืงื–ืึทืžืงื™ื™ึทื˜! ื“ื™ ื“ื™ืกืงืจื™ื™ื‘ื“ ืžืขื˜ื”ืึธื“ืก ืคึฟืึทืจ ืงืจื™ื™ื™ื˜ื™ื ื’ ืฉืœื™ืกืœืขืŸ ืื•ืŸ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ื–ืขื ืขืŸ ืคึผืึทืกื™ืง ืคึฟืึทืจ ื˜ืขืกื˜ื™ื ื’ ืื•ืŸ ื–ืขื ืขืŸ ื ื™ืฉื˜ ื‘ื“ืขื” ืคึฟืึทืจ ื ื•ืฆืŸ ืื™ืŸ ืงืึทืžื‘ืึทื˜ ืžืึธื“ืข. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื ื•ืฆืŸ ืฉืœื™ืกืœืขืŸ ืื•ืŸ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืืจื•ื™ืก ื“ื•ืจืš ื“ื™ื™ืŸ ื˜ืจืึทืกื˜ื™ื“ ืกืขืจื˜ืึทืคืึทืงื™ื™ืฉืึทืŸ ืื•ื™ื˜ืึธืจื™ื˜ืขื˜ ืึธื“ืขืจ ืึทืŸ ืึทืงืจืขื“ื™ื˜ื™ื“ ืกืขืจื˜ืึทืคืึทืงื™ื™ืฉืึทืŸ ืื•ื™ื˜ืึธืจื™ื˜ืขื˜.
ื“ื™ PAM ืžืึธื“ื•ืœืข ืื™ื– ื“ื™ื–ื™ื™ื ื“ ืฆื• ื‘ืึทืฉื™ืฆืŸ ื”ื™ื’ืข ืงืึธืžืคึผื™ื•ื˜ืขืจืก ืื•ืŸ ืื™ื– ื“ื™ื–ื™ื™ื ื“ ืฆื• ืึทืจื‘ืขื˜ืŸ ืื™ืŸ ืงืœื™ื™ืŸ ืึธืจื’ืึทื ืึทื–ื™ื™ืฉืึทื ื–. ื–ื™ื ื˜ ืขืก ื–ืขื ืขืŸ ื•ื•ื™ื™ื ื™ืง ื ื™ืฆืขืจืก, ื“ืขืจ ืึทื“ืžื™ื ื™ืกื˜ืจืึทื˜ืึธืจ ืงืขื ืขืŸ ืžืึธื ื™ื˜ืึธืจ ื“ื™ ืจืขื•ื•ืึธืงืึทื˜ื™ืึธืŸ ืคื•ืŸ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืื•ืŸ ืžืึทื ื™ื•ืึทืœื™ ืคืึทืจืฉืคึผืึทืจืŸ ืึทืงืึทื•ื ืฅ, ื•ื•ื™ ื’ืขื–ื•ื ื˜ ื•ื•ื™ ื“ื™ ื’ื™ืœื˜ื™ืงื™ื™ึทื˜ ืฆื™ื™ึทื˜ ืคื•ืŸ ืกืขืจื˜ื™ืคื™ืงืึทืฅ. ื“ื™ PAM ืžืึธื“ื•ืœืข ืงืขืŸ ื ืึธืš ื ื™ืฉื˜ ื•ื•ื™ืกืŸ ื•ื•ื™ ืฆื• ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ื ื™ืฆืŸ CRL ืื•ืŸ ื‘ื•ื™ืขืŸ ืฆื•ื˜ืจื•ื™ ืงื™ื™ื˜ืŸ.

ื“ืขืจ ื’ืจื™ื ื’ ื•ื•ืขื’ (ื“ื•ืจืš ื‘ืœืขื˜ืขืจืขืจ)

ืฆื• ืงืจื™ื’ืŸ ืึท ืคึผืจืึธื‘ืข ื‘ืึทื•ื•ื™ื™ึทื–ืŸ, ื ื•ืฆืŸ ื•ื•ืขื‘ ืกืขืจื•ื•ื™ืก "ืจื•ื˜ืึธืงืขืŸ ืจืขื’ื™ืกื˜ืจืืฆื™ืข ืฆืขื ื˜ืขืจ". ื“ืขืจ ืคึผืจืึธืฆืขืก ื•ื•ืขื˜ ื ืขืžืขืŸ ื ื™ื˜ ืžืขืจ ื•ื•ื™ 5 ืžื™ื ื•ื˜.

ื“ื™ ื’ื™ืง ืก ื•ื•ืขื’ (ื“ื•ืจืš ื“ื™ ืงืึทื ืกืึธื•ืœ ืื•ืŸ ืขืคืฉืขืจ ื“ื™ ืงืึทืžืคึผื™ื™ืœืขืจ)

ืงื•ืง ื“ื™ OpenSC ื•ื•ืขืจืกื™ืข
$ opensc-tool --version
ืื•ื™ื‘ ื“ื™ ื•ื•ืขืจืกื™ืข ืื™ื– ื•ื•ื™ื™ื ื™ืงืขืจ ื•ื•ื™ 0.20, ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ ืึธื“ืขืจ ื‘ื•ื™ืขืŸ pkcs11-ืžื›ืฉื™ืจ ืฆื•ื•ื™ื™ึทื’ ืžื™ื˜ GOST-2012 ืฉื˜ื™ืฆืŸ ืคึฟื•ืŸ ืื•ื ื“ื–ืขืจ GitHub (ืื™ืŸ ื“ืขืจ ืฆื™ื™ื˜ ืคื•ืŸ ืืจื•ื™ืกื’ืขื‘ืŸ ืคื•ืŸ ื“ืขื ืึทืจื˜ื™ืงืœ, ืžืขืœื“ื•ื ื’ 0.20 ืื™ื– ื ืึธืš ื ื™ืฉื˜ ื‘ืืคืจื™ื™ื˜) ืึธื“ืขืจ ืคึฟื•ืŸ ื“ื™ ื‘ืขืœ ืฆื•ื•ื™ื™ึทื’ ืคื•ืŸ ื“ื™ ื”ื•ื™ืคึผื˜ OpenSC ืคึผืจื•ื™ืขืงื˜ ื ื™ื˜ ืฉืคึผืขื˜ืขืจ ื˜ื•ืขืŸ 8cf1e6f

ื“ื–ืฉืขื ืขืจื™ื™ื˜ ืึท ืฉืœื™ืกืœ ืคึผืึธืจ ืžื™ื˜ ื“ื™ ืคืืœื’ืขื ื“ืข ืคึผืึทืจืึทืžืขื˜ืขืจืก:
--key-type: GOSTR3410-2012-512:ะ (ะ“ะžะกะข-2012 512 ะฑะธั‚ c ะฟะฐั€ะฐะผัะตั‚ะพะผ ะ), GOSTR3410-2012-256:A (ะ“ะžะกะข-2012 256 ะฑะธั‚ ั ะฟะฐั€ะฐะผัะตั‚ะพะผ A)

--id: ืึธื‘ื“ื–ืฉืขืงื˜ ืื™ื“ืขื ื˜ื™ืคื™ืฆื™ืจืŸ (CKA_ID) ื•ื•ื™ ืฆื•ื•ื™ื™-ืฆื™ืคึฟืขืจ ื”ืขืงืก ื›ืึทืจืึทืงื˜ืขืจ ื ื•ืžืขืจืŸ ืคื•ืŸ ื“ื™ ASCII ื˜ื™ืฉ. ื ื™ืฆืŸ ื‘ืœื•ื™ื– ASCII ืงืึธื•ื“ื– ืคึฟืึทืจ ืคึผืจื™ื ื˜ืึทื‘ืึทืœ ืื•ืชื™ื•ืช, ื•ื•ื™ื™ึทืœ ... ื™ื“ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื“ื•ืจื›ื’ืขื’ืื ื’ืขืŸ ืฆื• OpenSSL ื•ื•ื™ ืึท ืฉื˜ืจื™ืงืœ. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ื“ื™ ASCII ืงืึธื“ "3132" ืงืึธืจืึทืกืคึผืึทื ื“ื– ืฆื• ื“ื™ ืฉื˜ืจื™ืงืœ "12". ืคึฟืึทืจ ืงืึทื ื•ื•ื™ื ื™ืึทื ืก, ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ืึธื ืœื™ื™ืŸ ื“ื™ื ืกื˜ ืคึฟืึทืจ ืงืึทื ื•ื•ืขืจื˜ื™ื ื’ ืกื˜ืจื™ื ื’ืก ืฆื• ASCII ืงืึธื•ื“ื–.

$ ./pkcs11-tool --module /usr/lib/librtpkcs11ecp.so --keypairgen --key-type GOSTR3410-2012-512:A -l --id 3132

ื•ื•ื™ื™ึทื˜ืขืจ ืžื™ืจ ื•ื•ืขืœืŸ ืžืึทื›ืŸ ืึท ื‘ืึทื•ื•ื™ื™ึทื–ืŸ. ืฆื•ื•ื™ื™ ื•ื•ืขื’ืŸ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื“ื™ืกืงืจื™ื™ื‘ื“ ืื•ื ื˜ืŸ: ื“ืขืจ ืขืจืฉื˜ืขืจ ืื™ื– ื“ื•ืจืš ืึท CA (ืžื™ืจ ื•ื•ืขืœืŸ ื ื•ืฆืŸ ืคึผืจื•ื‘ื™ืจืŸ CAs), ื“ื™ ืจื’ืข ืื™ื– ื–ื™ืš-ื’ืขื—ืชืžืขื˜. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืื™ืจ ืขืจืฉื˜ืขืจ ื“ืึทืจืคึฟืŸ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ืื•ืŸ ืงืึทื ืคื™ื’ื™ืขืจ OpenSSL ื•ื•ืขืจืกื™ืข 1.1 ืึธื“ืขืจ ืฉืคึผืขื˜ืขืจ ืฆื• ืึทืจื‘ืขื˜ืŸ ืžื™ื˜ Rutoken ื“ื•ืจืš ืึท ืกืคึผืขืฆื™ืขืœ ืจื˜ืขื ื’ื™ื ืข ืžืึธื“ื•ืœืข ืžื™ื˜ ื“ื™ ืžืึทื ื•ืึทืœ. ื™ื ืกื˜ืึธืœื™ื ื’ ืื•ืŸ ืงืึทื ืคื™ื’ื™ืขืจ OpenSSL.
ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ: ืคึฟืึทืจ '--id 3132'ืื™ืŸ OpenSSL ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ "pkcs11:id=12".

ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ื“ื™ ืกืขืจื•ื•ื™ืกืขืก ืคื•ืŸ ืึท ืคึผืจืึธื‘ืข CA, ืคื•ืŸ ื•ื•ืึธืก ืขืก ื–ืขื ืขืŸ ืคื™ืœืข, ืœืžืฉืœ, ื“ืึธ, ื“ืึธ ะธ ื“ืึธ, ืคึฟืึทืจ ื“ืขื ืžื™ืจ ื•ื•ืขืœืŸ ืžืึทื›ืŸ ืึท ื‘ืงืฉื” ืคึฟืึทืจ ืึท ื‘ืึทื•ื•ื™ื™ึทื–ืŸ

ืืŸ ืื ื“ืขืจ ืึธืคึผืฆื™ืข ืื™ื– ืฆื• ื’ืขื‘ืŸ ืื™ืŸ ืคื•ื™ืœืงื™ื™ึทื˜ ืื•ืŸ ืžืึทื›ืŸ ืึท ื–ื™ืš-ื’ืขื—ืชืžืขื˜
$ openssl req -utf8 -new -keyform engine -key "pkcs11:id=12" -engine rtengine -out req.csr

ื•ืคึผืœืึธืึทื“ื™ื ื’ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืฆื• ื“ื™ ืžื™ื˜ืœ
$ openssl req -utf8 -x509 -keyform engine -key "pkcs11:id=12" -engine rtengine -out cert.cer

6) ืจืขื’ื™ืกื˜ืจื™ืจืŸ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ืŸ ื“ื™ ืกื™ืกื˜ืขื

ืžืึทื›ืŸ ื–ื™ื›ืขืจ ื“ื™ื™ืŸ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืงื•ืงื˜ ื•ื•ื™ ืึท base64 ื˜ืขืงืข:

ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

ืื•ื™ื‘ ื“ื™ื™ืŸ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืงื•ืงื˜ ื•ื•ื™ ื“ืึธืก:

ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

ื“ืขืžืึธืœื˜ ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื‘ื™ื™ึทื˜ืŸ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคื•ืŸ DER ืคึฟืึธืจืžืึทื˜ ืฆื• PEM ืคึฟืึธืจืžืึทื˜ (ื‘ืึทืกืข64)

$ openssl x509 -in cert.crt -out cert.pem -inform DER -outform PEM
ืžื™ืจ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื•ื•ื™ื“ืขืจ ืึทื– ืึทืœืฅ ืื™ื– ืื™ืŸ ืกื“ืจ ืื™ืฆื˜.

ืœื™ื™ื’ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืฆื• ื“ืขืจ ืจืฉื™ืžื” ืคื•ืŸ ื˜ืจืึทืกื˜ื™ื“ ืกืขืจื˜ื™ืคื™ืงืึทืฅ
$ mkdir ~/.eid
$ chmod 0755 ~/.eid
$ cat cert.pem >> ~/.eid/authorized_certificates
$ chmod 0644 ~/.eid/authorized_certificates
ื“ื™ ืœืขืฆื˜ืข ืฉื•ืจื” ืคึผืจืึทื˜ืขืงืฅ ื“ื™ ืจืฉื™ืžื” ืคื•ืŸ ื˜ืจืึทืกื˜ื™ื“ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืคื•ืŸ ืึทืงืกืึทื“ืขื ืึทืœื™ ืึธื“ืขืจ ื‘ืขืงื™ื•ื•ืŸ ื’ืขื‘ื™ื˜ืŸ ื“ื•ืจืš ืื ื“ืขืจืข ื ื™ืฆืขืจืก. ื“ืึธืก ืคึผืจื™ื•ื•ืขื ืฅ ืขืžืขืฆืขืจ ืคื•ืŸ ืึทื“ื™ื ื’ ื–ื™ื™ืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ื“ืึธ ืื•ืŸ ืงืขื ืขืŸ ืฆื• ืงืœืึธืฅ ืื™ืŸ ืื•ื™ืฃ ื“ื™ื™ืŸ ื‘ื™ื›ืึทืฃ.

7) ืฉื˜ืขืœืŸ ืึทืจื•ื™ืฃ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ

ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืื•ื ื“ื–ืขืจ PAM ืžืึธื“ื•ืœืข ืื™ื– ื’ืึธืจ ื ืึธืจืžืึทืœ ืื•ืŸ ืื™ื– ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืื™ืŸ ืคึผื•ื ืงื˜ ื“ื™ ื–ืขืœื‘ืข ื•ื•ืขื’ ื•ื•ื™ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืื ื“ืขืจืข ืžืึทื“ื–ืฉื•ืœื–. ืฉืึทืคึฟืŸ ืฆื• ื˜ืขืงืข /usr/share/pam-configs/rutoken-gost-pam ืžื™ื˜ ื“ื™ ืคื•ืœ ื ืึธืžืขืŸ ืคื•ืŸ ื“ื™ ืžืึธื“ื•ืœืข, ืฆื™ ืขืก ืื™ื– ืขื ื™ื™ื‘ืึทืœื“ ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜, ื“ื™ ื‘ื™ืœื›ืขืจืงื™ื™ึทื˜ ืคื•ืŸ ื“ื™ ืžืึธื“ื•ืœืข ืื•ืŸ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืคึผืึทืจืึทืžืขื˜ืขืจืก.
ื“ื™ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืคึผืึทืจืึทืžืขื˜ืขืจืก ืึทื ื˜ื”ืึทืœื˜ืŸ ืจืขืงื•ื•ื™ืจืขืžืขื ืฅ ืคึฟืึทืจ ื“ื™ ื”ืฆืœื—ื” ืคื•ืŸ ื“ื™ ืึธืคึผืขืจืึทืฆื™ืข:

  • ืคืืจืœืื ื’ื˜: ืึทื–ืึท ืžืึทื“ื–ืฉื•ืœื– ืžื•ื–ืŸ ืฆื•ืจื™ืงืงื•ืžืขืŸ ืึท positive ืขื ื˜ืคืขืจ. ืื•ื™ื‘ ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜ ืคื•ืŸ ืึท ืžืึธื“ื•ืœืข ืจื•ืคืŸ ื›ึผื•ืœืœ ืึท ื ืขื’ืึทื˜ื™ื•ื• ืขื ื˜ืคืขืจ, ื“ืึธืก ื•ื•ืขื˜ ืจืขื–ื•ืœื˜ืึทื˜ ืื™ืŸ ืึท ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ื˜ืขื•ืช. ื“ื™ ื‘ืงืฉื” ื•ื•ืขื˜ ื–ื™ื™ืŸ ื“ืจืึทืคึผื˜, ืึธื‘ืขืจ ื“ื™ ืจื•ืขืŸ ืžืึทื“ื–ืฉื•ืœื– ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขืจื•ืคึฟืŸ.
  • ืคืืจืœืื ื’ื˜: ืขื ืœืขืš ืฆื• ืคืืจืœืื ื’ื˜, ืึธื‘ืขืจ ืžื™ื“ ืคื™ื™ืœื– ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ืŸ ื™ื’ื ืึธืจื– ืื ื“ืขืจืข ืžืึทื“ื–ืฉื•ืœื–.
  • ื’ืขื ื•ื’: ืื•ื™ื‘ ืงื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืคืืจืœืื ื’ื˜ ืึธื“ืขืจ ื’ืขื ื•ื’ ืžืึทื“ื–ืฉื•ืœื– ืื™ื™ื“ืขืจ ืึทื–ืึท ืึท ืžืึธื“ื•ืœืข ื”ืื˜ ื ื™ืฉื˜ ื‘ืึทืงื•ืžืขืŸ ืึท ื ืขื’ืึทื˜ื™ื•ื• ืจืขื–ื•ืœื˜ืึทื˜, ื“ืขืจ ืžืึธื“ื•ืœืข ื•ื•ืขื˜ ืฆื•ืจื™ืงืงื•ืžืขืŸ ืึท positive ืขื ื˜ืคืขืจ. ื“ื™ ืจื•ืขืŸ ืžืึทื“ื–ืฉื•ืœื– ื•ื•ืขื˜ ื–ื™ื™ืŸ ืื™ื’ื ืึธืจื™ืจื˜.
  • ืึทืคึผืฉืึทื ืึทืœ: ืื•ื™ื‘ ืขืก ื–ืขื ืขืŸ ืงื™ื™ืŸ ืคืืจืœืื ื’ื˜ ืžืึทื“ื–ืฉื•ืœื– ืื•ื™ืฃ ื“ื™ ืึธื ืœื™ื™ื’ืŸ ืื•ืŸ ืงื™ื™ืŸ ืคื•ืŸ ื“ื™ ื’ืขื ื•ื’ ืžืึทื“ื–ืฉื•ืœื– ื’ืขื‘ืŸ ืึท positive ืจืขื–ื•ืœื˜ืึทื˜, ืื™ืŸ ืžื™ื ื“ืกื˜ืขืจ ืื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืึทืคึผืฉืึทื ืึทืœ ืžืึทื“ื–ืฉื•ืœื– ืžื•ื–ืŸ ืฆื•ืจื™ืงืงื•ืžืขืŸ ืึท positive ืจืขื–ื•ืœื˜ืึทื˜.

ื’ืึทื ืฅ ื˜ืขืงืข ืื™ื ื”ืึทืœื˜ /usr/share/pam-configs/rutoken-gost-pam:
Name: Rutoken PAM GOST
Default: yes
Priority: 800
Auth-Type: Primary
Auth: sufficient /usr/lib/librtpam.so.1.0.0 /usr/lib/librtpkcs11ecp.so

ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

ืจืึทื˜ืขื•ื•ืขืŸ ื“ื™ ื˜ืขืงืข, ื“ืขืžืึธืœื˜ ื•ื™ืกืคื™ืจืŸ
$ sudo pam-auth-update
ืื™ืŸ ื“ื™ ืคึฟืขื ืฆื˜ืขืจ ื•ื•ืึธืก ืื™ื– ืืจื•ื™ืก, ืฉื˜ืขืœืŸ ืึท ืึทืกื˜ืขืจื™ืกืง ื•ื•ื™ื™ึทื˜ืขืจ Rutoken PAM GOST ืื•ืŸ ื’ื™ื˜ OK

ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

8) ืงื•ืง ื“ื™ ืกืขื˜ื˜ื™ื ื’ืก

ืฆื• ืคึฟืึทืจืฉื˜ื™ื™ืŸ ืึทื– ืึทืœืฅ ืื™ื– ืงืึทื ืคื™ื’ื™ืขืจื“, ืึธื‘ืขืจ ืื™ืŸ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืฆื™ื™ื˜ ื ื™ืฉื˜ ืคืึทืจืœื™ืจืŸ ื“ื™ ืคื™ื™ื™ืงื™ื™ื˜ ืฆื• ืงืœืึธืฅ ืื™ืŸ ื“ื™ ืกื™ืกื˜ืขื, ืึทืจื™ื™ึทืŸ ื“ื™ ื‘ืึทืคึฟืขืœ
$ sudo login
ืึทืจื™ื™ึทืŸ ื“ื™ื™ืŸ ื ืืžืขืŸ. ืึทืœืฅ ืื™ื– ืงืึทื ืคื™ื’ื™ืขืจื“ ืจื™ื›ื˜ื™ืง ืื•ื™ื‘ ื“ื™ ืกื™ืกื˜ืขื ืจื™ืงื•ื•ื™ื™ืขืจื– ืึท PIN ืงืึธื“ ืคึฟืึทืจ ื“ื™ ืžื™ื˜ืœ.

ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

9) ืงืึทื ืคื™ื’ื™ืขืจ ื“ื™ ืงืึธืžืคึผื™ื•ื˜ืขืจ ืฆื• ื–ื™ื™ืŸ ืืคื’ืขืฉื˜ืขืœื˜ ื•ื•ืขืŸ ื“ื™ ืกื™ืžืขืŸ ืื™ื– ื™ืงืกื˜ืจืึทืงื˜ื™ื“

ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ ืื™ืŸ ื“ืขื ืคึผืขืงืœ libpam-pkcs11 ื ื•ืฆืŸ ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ pkcs11_eventmgr, ื•ื•ืึธืก ืึทืœืึทื•ื– ืื™ืจ ืฆื• ื“ื•ืจื›ืคื™ืจืŸ ืคืึทืจืฉื™ื“ืŸ ืึทืงืฉืึทื ื– ื•ื•ืขืŸ PKCS #11 ื’ืขืฉืขืขื ื™ืฉืŸ ืคึผืึทืกื™ืจืŸ.
ืคึฟืึทืจ ืกืขื˜ื˜ื™ื ื’ืก pkcs11_eventmgr ืกืขืจื•ื•ืขืก ื•ื•ื™ ืึท ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข: /etc/pam_pkcs11/pkcs11_eventmgr.conf
ืคึฟืึทืจ ืคืึทืจืฉื™ื“ืขื ืข ืœื™ื ื•ืงืก ื“ื™ืกื˜ืจื™ื‘ื™ื•ืฉืึทื ื–, ื“ื™ ื‘ืึทืคึฟืขืœ ื•ื•ืึธืก ื’ืขืคึฟื™ืจื˜ ืึท ื—ืฉื‘ื•ืŸ ืฆื• ื–ื™ื™ืŸ ืคืืจืฉืคืืจื˜ ื•ื•ืขืŸ ืึท ืกืžืึทืจื˜ ืงืึทืจื˜ืœ ืึธื“ืขืจ ืกื™ืžืขืŸ ืื™ื– ืึทื•ื•ืขืงื’ืขื ื•ืžืขืŸ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืึทื ื“ืขืจืฉ. ืกืขื ื˜ื™ืžืขื˜ืขืจ. event card_remove.
ื ื‘ื™ื™ืฉืคึผื™ืœ ืคื•ืŸ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข ืื™ื– ื’ืขื•ื•ื™ื–ืŸ ืื•ื ื˜ืŸ:

pkcs11_eventmgr
{
    # ะ—ะฐะฟัƒัะบ ะฒ ะฑัะบะณั€ะฐัƒะฝะดะต
    daemon = true;
     
    # ะะฐัั‚ั€ะพะนะบะฐ ัะพะพะฑั‰ะตะฝะธะน ะพั‚ะปะฐะดะบะธ
    debug = false;
 
    # ะ’ั€ะตะผั ะพะฟั€ะพัะฐ ะฒ ัะตะบัƒะฝะดะฐั…
    polling_time = 1;
 
    # ะฃัั‚ะฐะฝะพะฒะบะฐ ั‚ะฐะนะผ-ะฐัƒั‚ะฐ ะฝะฐ ัƒะดะฐะปะตะฝะธะต ะบะฐั€ั‚ั‹
    # ะŸะพ-ัƒะผะพะปั‡ะฐะฝะธัŽ 0
    expire_time = 0;
 
    # ะ’ั‹ะฑะพั€ pkcs11 ะฑะธะฑะปะธะพั‚ะตะบะธ ะดะปั ั€ะฐะฑะพั‚ั‹ ั ะ ัƒั‚ะพะบะตะฝ
    pkcs11_module = usr/lib/librtpkcs11ecp.so;
 
    # ะ”ะตะนัั‚ะฒะธั ั ะบะฐั€ั‚ะพะน
    # ะšะฐั€ั‚ะฐ ะฒัั‚ะฐะฒะปะตะฝะฐ:
    event card_insert {
        # ะžัั‚ะฐะฒะปัะตะผ ะทะฝะฐั‡ะตะฝะธั ะฟะพ ัƒะผะพะปั‡ะฐะฝะธัŽ (ะฝะธั‡ะตะณะพ ะฝะต ะฟั€ะพะธัั…ะพะดะธั‚)
        on_error = ignore ;
 
        action = "/bin/false";
    }
 
    # ะšะฐั€ั‚ะฐ ะธะทะฒะปะตั‡ะตะฝะฐ
    event card_remove {
        on_error = ignore;
         
        # ะ’ั‹ะทั‹ะฒะฐะตะผ ั„ัƒะฝะบั†ะธัŽ ะฑะปะพะบะธั€ะพะฒะบะธ ัะบั€ะฐะฝะฐ
        
        # ะ”ะปั GNOME 
        action = "dbus-send --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.Lock";
        
        # ะ”ะปั XFCE
        # action = "xflock4";
        
        # ะ”ะปั Astra Linux (FLY)
        # action = "fly-wmfunc FLYWM_LOCK";
    }
 
    # ะšะฐั€ั‚ะฐ ะดะพะปะณะพะต ะฒั€ะตะผั ะธะทะฒะปะตั‡ะตะฝะฐ
    event expire_time {
        # ะžัั‚ะฐะฒะปัะตะผ ะทะฝะฐั‡ะตะฝะธั ะฟะพ ัƒะผะพะปั‡ะฐะฝะธัŽ (ะฝะธั‡ะตะณะพ ะฝะต ะฟั€ะพะธัั…ะพะดะธั‚)
        on_error = ignore;
 
        action = "/bin/false";
    }
}

ื ืึธืš ื“ืขื, ืœื™ื™ื’ืŸ ื“ื™ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ pkcs11_eventmgr ืฆื• ืกื˜ืึทืจื˜ืึทืคึผ. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืจืขื“ืึทื’ื™ืจืŸ ื“ื™ .ื‘ืึทืฉ_ืคึผืจืึธืคื™ืœ ื˜ืขืงืข:
$ nano /home/<ะธะผั_ะฟะพะปัŒะทะพะฒะฐั‚ะตะปั>/.bash_profile
ืœื™ื™ื’ ื“ื™ ืฉื•ืจื” pkcs11_eventmgr ืฆื• ื“ื™ ืกื•ืฃ ืคื•ืŸ ื“ืขืจ ื˜ืขืงืข ืื•ืŸ ืจืขื‘ืึธืึธื˜.

ื“ื™ ื“ื™ืกืงืจื™ื™ื‘ื“ ืกื˜ืขืคึผืก ืคึฟืึทืจ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื“ื™ ืึธืคึผืขืจื™ื™ื˜ื™ื ื’ ืกื™ืกื˜ืขื ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ื•ื•ื™ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ืื™ืŸ ืงื™ื™ืŸ ืžืึธื“ืขืจืŸ ืœื™ื ื•ืงืก ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’, ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ ื“ื™ื ืขืจ.

ื•ื•ื™ ืฆื• ื ื•ืฆืŸ PAM ืžืึทื“ื–ืฉื•ืœื– ืคึฟืึทืจ ื”ื™ื’ืข ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ืœื™ื ื•ืงืก ื ื™ืฆืŸ GOST-2012 ืฉืœื™ืกืœืขืŸ ืื•ื™ืฃ Rutoken

ืกืึธืฃ

ืœื™ื ื•ืงืก ืคึผืงืก ื•ื•ืขืจืŸ ื™ื ืงืจื™ืกื™ื ื’ืœื™ ืคืึธืœืงืก ืื™ืŸ ืจื•ืกื™ืฉ ืจืขื’ื™ืจื•ื ื’ ื™ื™ื“ื–ืฉืึทื ืกื™ื–, ืื•ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืคืึทืจืœืึธื–ืœืขืš ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ื“ืขื ืึทืก ืื™ื– ื ื™ื˜ ืฉื˜ืขื ื“ื™ืง ื’ืจื™ื ื’. ืžื™ืจ ื•ื•ืขืœืŸ ื–ื™ื™ืŸ ืฆื•ืคืจื™ื“ืŸ ืฆื• ื”ืขืœืคึฟืŸ ืื™ืจ ืกืึธืœื•ื•ืข ื“ื™ "ืฉืคึผืจื™ื›ื•ื•ืึธืจื˜ ืคึผืจืึธื‘ืœืขื" ืžื™ื˜ ื“ืขื ืคื™ืจืขืจ ืื•ืŸ ืจื™ืœื™ื™ืึทื‘ืœื™ ื‘ืึทืฉื™ืฆืŸ ืึทืงืกืขืก ืฆื• ื“ื™ื™ืŸ ืคึผื™ืกื™ ืึธืŸ ืกืคึผืขื ื“ื™ื ื’ ืึท ืคึผืœืึทืฅ ืคื•ืŸ ืฆื™ื™ื˜.

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’