On 04/26/2010 09:51 AM, Arshad Noor wrote:
Do you have any update on the JSS issue, Chandrasekar? Thanks.
I don't. We may need to debug the JSS code to figure out what the problem is....
Arshad Noor StrongAuth, Inc.
Arshad Noor wrote:
No luck.
------------- # pet105:~> setenforce 0 # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~> -------------
Output from audit.log:
------------- type=MAC_STATUS msg=audit(1271980444.565:345): enforcing=0 old_enforcing=1 auid=500 ses=5 type=SYSCALL msg=audit(1271980444.565:345): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff300dfb20 a2=1 a3=fffffff8 items=0 ppid=32217 pid=32292 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=5 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) -------------
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
On 04/22/2010 04:44 PM, Arshad Noor wrote:
Interesting; it did not:
# pet105:~> modutil -dbdir /var/lib/subca01/alias/ -nocertdb -list
Listing of PKCS #11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded
slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services
slot: NSS User Private Key and Certificate Services token: NSS Certificate DB
2. CryptoServer library name: /usr/bin/libcs2_pkcs11.so slots: 1 slot attached status: loaded
slot: CryptoServer Device '/dev/cs2' - Slot No: 0 token: CBUAETEST ----------------------------------------------------------- # pet105:~> TokenInfo /var/lib/subca01/alias Database Path: /var/lib/subca01/alias Found external module 'NSS Internal PKCS #11 Module' # pet105:~>
And there were no SELinux errors in the audit log.
Can you 'setenforce 0' (putting selinux to permissive mode ) and try one more time ?.
Arshad Noor StrongAuth, Inc.
Chandrasekar Kannan wrote:
Looks like the NSS layer has no problems identifying the token. can you use this tool and see if the JSS layer can see it as well ?
http://www.redhat.com/docs/manuals/cert-system/8.0/cli/html/TokenInfo.html
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users Actually, I did spend some time looking into JSS code. The result was inconclusive. The code appeared to be reasonable. I do suspect, however, without looking closely at the code, that somehow the module is unloaded somewhere along the way. I'm curious whether this is an issue on this particular HSM, or if it's a matter of handling external modules (including software modules) in general. Has anyone had any success installing/using certicom module on this
Chandrasekar Kannan wrote: platform, for example? Again, I did not see any email from another member (StJohns?) that you mentioned claiming success with Utimaco HSM on a 32 bit machine... could you please forward the email? Another thing is, I'm not familiar with Utimaco HSM, but you might want to find out how to turn on debugger. Otherwise, try turning on NSS debugging, which might give you some clue. Christina