Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    "pcscd PC/SC Smart Card Daemon" ?

    Scheduled Pinned Locked Moved General pfSense Questions
    70 Posts 22 Posters 29.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DaddyGoD
      DaddyGo @chudak
      last edited by

      @chudak said in "pcscd PC/SC Smart Card Daemon" ?:

      Why all of the sudden it's exposed in 2.5.0 ?

      That's a good question because it has been around for a long time:
      https://www.freshports.org/devel/pcsc-lite

      Maybe something new with SD cards + API(s) will be introduced to it

      Cats bury it so they can't see it!
      (You know what I mean if you have a cat)

      1 Reply Last reply Reply Quote 0
      • viktor_gV
        viktor_g Netgate
        last edited by

        support for PKCS#11 authentication (e.g. hardware tokens such as Yubikey) for IPsec: https://redmine.pfsense.org/issues/9878

        DaddyGoD chudakC 2 Replies Last reply Reply Quote 1
        • DaddyGoD
          DaddyGo @viktor_g
          last edited by

          @viktor_g said in "pcscd PC/SC Smart Card Daemon" ?:

          e.g. hardware tokens such as Yubikey

          Oh that's great

          Cats bury it so they can't see it!
          (You know what I mean if you have a cat)

          1 Reply Last reply Reply Quote 0
          • chudakC
            chudak @viktor_g
            last edited by

            @viktor_g said in "pcscd PC/SC Smart Card Daemon" ?:

            support for PKCS#11 authentication (e.g. hardware tokens such as Yubikey) for IPsec: https://redmine.pfsense.org/issues/9878

            Ok makes sense, thx !

            Is there a reason to keep it on and what the best way to disable it ?

            1 Reply Last reply Reply Quote 0
            • I
              Izaac
              last edited by

              @chudak

              Anybody can shed light?

              NetGate decided that despite:

              • the fact that they don't ship a piece of hardware with such an inerface;
              • that almost no one uses smartcards for this purpose;
              • the Yubikeys are better handed by a different interface;
              • that using a Yubikey for this kind of authentication, i.e. leaving it plugged into your piece of network hardware at all times, pretty much undermines its security model;
              • would be entirely more appropriate as a package

              it would make sense to have this privileged code running at all times on some of the most memory and processor constrained hardware, without any ability to configure or even disable it, and to plunge the entire system into an error state if should happen to not be running.

              A 1 Reply Last reply Reply Quote 5
              • A
                anthonys @Izaac
                last edited by anthonys

                @izaac In the face of it also having a memory leak
                https://redmine.pfsense.org/issues/12095
                which took my SG-1100 to 92% RAM, I have disabled
                4d9f1370-ba8b-4648-9e51-5347c04a268c-image.png

                D 1 Reply Last reply Reply Quote 2
                • M
                  mw
                  last edited by mw

                  You can stop the pcscd service from starting by editing your /etc/rc.bootup file.

                  Look for the following:

                  /* pcscd daemon must be started before IPsec */
                  echo "Starting PC/SC Smart Card Services...";
                  mwexec_bg("/usr/local/sbin/pcscd");
                  echo "done.\n";
                  

                  Comment out the startup code, like this:

                  /* pcscd daemon must be started before IPsec */
                  /*
                  echo "Starting PC/SC Smart Card Services...";
                  mwexec_bg("/usr/local/sbin/pcscd");
                  echo "done.\n";
                  */
                  

                  This code was added in this revision.

                  chudakC P 2 Replies Last reply Reply Quote 2
                  • chudakC
                    chudak @mw
                    last edited by

                    @mw said in "pcscd PC/SC Smart Card Daemon" ?:

                    This code was added in

                    That's useful, thx

                    Wonder why it's enabled by default ?!

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      It won't be enabled by default for long:

                      https://redmine.pfsense.org/issues/11933

                      Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      1 Reply Last reply Reply Quote 1
                      • P
                        psp @mw
                        last edited by

                        @mw said in "pcscd PC/SC Smart Card Daemon" ?:

                        Comment out the startup code, like this:

                        Just for info, commenting out the startup code and using IPSec, logs are filled up by these errors:
                        -- Jul 20 09:28:46 charon 78779 02[CFG] error in C_WaitForSlotEvent: GENERAL_ERROR

                        M 1 Reply Last reply Reply Quote 1
                        • M
                          mw @psp
                          last edited by

                          @psp Thanks for the heads up. I don't currently make use of IPsec so didn't think about the consequences.

                          1 Reply Last reply Reply Quote 0
                          • viktor_gV
                            viktor_g Netgate
                            last edited by

                            You can use 299.diff patch on 21.05/2.5.2

                            after applying you can disable pcscd on the VPN/ IPsec / Advanced Settings page:
                            Screenshot from 2021-07-21 11-21-38.png

                            chudakC 1 Reply Last reply Reply Quote 2
                            • chudakC
                              chudak @viktor_g
                              last edited by

                              @viktor_g said in "pcscd PC/SC Smart Card Daemon" ?:

                              You can use 299.diff patch on 21.05/2.5.2

                              after applying you can disable pcscd on the VPN/ IPsec / Advanced Settings page:
                              Screenshot from 2021-07-21 11-21-38.png

                              I applied the patch and enabled PKCS#11 Support (which I don't use BTW)

                              Saw the service go red and then green again, I guess restarted.

                              db1ba327-76a5-4825-a6da-1d7df16109c3-image.png

                              a1707664-e498-41aa-9ac6-82e65828a81e-image.png

                              I thought the service would be completely removed and not sure what exactly changed ?

                              Thx

                              1 Reply Last reply Reply Quote 0
                              • jimpJ
                                jimp Rebel Alliance Developer Netgate
                                last edited by

                                If you don't want it and don't use it, why did you go out of your way to enable it?

                                It's off by default which is what you'll want. After applying the patch, leave the box unchecked and then reboot.

                                Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                Need help fast? Netgate Global Support!

                                Do not Chat/PM for help!

                                chudakC O 2 Replies Last reply Reply Quote 0
                                • chudakC
                                  chudak @jimp
                                  last edited by

                                  @jimp said in "pcscd PC/SC Smart Card Daemon" ?:

                                  If you don't want it and don't use it, why did you go out of your way to enable it?

                                  See the initial post above, I am still trying to get rid of it exactly because I don't use it :)

                                  It's off by default which is what you'll want. After applying the patch, leave the box unchecked and then reboot.

                                  I did that and still see the red "pcscd PC/SC Smart Card Daemon" in the Service Status. Is it expected? If the answer is yes, why ?

                                  1 Reply Last reply Reply Quote 0
                                  • jimpJ
                                    jimp Rebel Alliance Developer Netgate
                                    last edited by

                                    The service is still there/defined but disabled. Several other services work the same way. Though it may not take much to hide it in this case. It's not a problem.

                                    Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                    Need help fast? Netgate Global Support!

                                    Do not Chat/PM for help!

                                    chudakC 2 Replies Last reply Reply Quote 1
                                    • chudakC
                                      chudak @jimp
                                      last edited by

                                      @jimp said in "pcscd PC/SC Smart Card Daemon" ?:

                                      The service is still there/defined but disabled. Several other services work the same way. Though it may not take much to hide it in this case. It's not a problem.

                                      OK I take that and thank you!

                                      Before it was not possible to disable it.

                                      It's just odd to see something disabled if you don't use it and even know where it's coming from.

                                      1 Reply Last reply Reply Quote 0
                                      • chudakC
                                        chudak @jimp
                                        last edited by

                                        @jimp

                                        To hide it - is it something that can be done locally?

                                        DaddyGoD 1 Reply Last reply Reply Quote 0
                                        • DaddyGoD
                                          DaddyGo @chudak
                                          last edited by

                                          @chudak said in "pcscd PC/SC Smart Card Daemon" ?:

                                          To hide it - is it something that can be done locally?

                                          We, for example, are not as bothered by this as you are ๐Ÿ˜‰

                                          Cats bury it so they can't see it!
                                          (You know what I mean if you have a cat)

                                          I 1 Reply Last reply Reply Quote 0
                                          • jimpJ
                                            jimp Rebel Alliance Developer Netgate
                                            last edited by

                                            I already added a note to the Redmine stating we'll need to hide the service. I'm not certain how long that might take or how much effort it will be. Probably not much but don't quote me on that.

                                            It is cosmetic only, it doesn't hurt anything. Not many people sit on the service status screen so it doesn't matter. If it bothers you in the widget you can hide it in the widget (hit the wrench in the titlebar of the service status widget, scroll down, uncheck it, save.)

                                            Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                            Need help fast? Netgate Global Support!

                                            Do not Chat/PM for help!

                                            1 Reply Last reply Reply Quote 4
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.