Anyone try to use a CAC reader?

[MurderBear]

I as you can guess am in the military and I was wondering if anyone has tried to get a CAC reader and download the certificates for it on the Steam Deck?

I tried a bit but, I haven't really made progress. I want to use my Steam Deck like a laptop when I go out of town for training.

Any help or just people showing interest is appreciated.

[knoxvilles_joker]

What are you trying to read or load? Basically the unit or whatever you use has to be on the HCL (hardware compatibility list) for linux...

[Minneyar]

Using a smartcard reader requires installing a root-level driver called pcscd. I haven't done that myself on the Deck, but doing so will first require disabling read-only mode on your Deck, then using pacman to install the daemon, and might require some manual configuration to get the daemon to recognize your reader and get your web browser to load the appropriate library. These pages might help:

https://help.steampowered.com/en/faqs/view/671A-4453-E8D2-323C
https://wiki.archlinux.org/title/Smartcards

The biggest catch is that any modifications you make to the root filesystem may get blown away the next time SteamOS is updated, so if you get it working, make sure you write down how so you can do it again after the next update.

[MurderBear]

Originally posted by knoxvilles_joker:

What are you trying to read or load? Basically the unit or whatever you use has to be on the HCL (hardware compatibility list) for linux...

I'm just using it for general websites like NROWS or MyPay.

I don't do admin for other people just myself.

[MurderBear]

Originally posted by Minneyar:

Using a smartcard reader requires installing a root-level driver called pcscd. I haven't done that myself on the Deck, but doing so will first require disabling read-only mode on your Deck, then using pacman to install the daemon, and might require some manual configuration to get the daemon to recognize your reader and get your web browser to load the appropriate library. These pages might help:

https://help.steampowered.com/en/faqs/view/671A-4453-E8D2-323C
https://wiki.archlinux.org/title/Smartcards

The biggest catch is that any modifications you make to the root filesystem may get blown away the next time SteamOS is updated, so if you get it working, make sure you write down how so you can do it again after the next update.

Thank you I will try that sometime soon and post the results.

[lancher_1]

I just dropped this as its own discussion entry titled "CAC Card setup on Steam Deck (Arch Linux) to login to DOD Websites (365 Email, DFAS MyPay, Etc) in January 2023". This worked for me as of this afternoon.

How to set up DOD CAC Login with the Steam Deck:

This is assuming you have the internet connected to your Steam Deck, boot in Steam OS desktop mode, and have a docking station with the typical input devices needed for this task (keyboard, mouse, and CAC reader).

-I had to do some plugging and unplugging with my mouse/keyboard on my dock. It seems like I had to plug my USB device in the center USB port for the others to work.

A.The only real extra difference between Steam Deck using Steam OS and any other Arch based Linux Distro is that you need to set a root password to use with sudo. From the terminal (SteamOS/KDE - konsole):

1A) Run "passwd" and set a password for the deck user.

2A) Disable read only mode: sudo btrfs property set -ts / ro false

3A) Initialize the pacman keyring with the default Arch Linux keys:
sudo pacman-key --populate archlinux

4A) Now you can install any typical Arch Linux package like this:

sudo pacman -S *Package Name*

Now moving on to general Arch Linux steps for setting up your CAC:

B.The following would be the process for setting up the CAC middleware on any Arch Linux installation including Steam OS on the Steam Deck.

1B) Install generic USB Chip/Smart Card Interface Devices (CCID) and Open Smart Card (OpenSC):

sudo pacman -S ccid
sudo pacman -S opensc

-If your CAC reader doesn't have a keypad (typical USB reader) go to “/etc/opensc.conf” and append "enable_pinpad=false" to the file.

2B) Start and enable pcscd.service by running: pcscd

-I had some trouble with this step, apparently a file that belonged to the pcscd.socket wasn’t set up right. This was fixed by running:

sudo systemctl restart pcscd.socket

3B) That should be all you need. However you can verify your smart card reader by installing pcsc-tools and running pcsc_scan:

sudo pacman -S pcsc-tools
pcsc_scan

-You should then see the smart card reader you have plugged into your machine and its status such as if there's a smart card inserted. You can quit this application by hitting "Ctrl+C" which is the typical Linux command line way of closing a program.

4B) Install Firefox. Apparently Firefox installed with snap doesn't work with smart cards correctly. If you already have Firefox installed from a software center/store (SteamOS - Discover) just go into that software store GUI and uninstall it. Go back to your terminal and install Firefox using pacman:

sudo pacman -S firefox

C. Now we're going to configure Firefox to work with a smart card reader and then install the DOD certificates.

1C) Download the latest DOD CAC certificates (DOD PKI PKCS#7 CA). This may require googling "download latest dod root certificates" and finding it. As of this writing it's hosted on https://public.cyber.mil at this URL:

https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/unclass-certificates_pkcs7_v5-6_dod.zip

-Save file and extract the folder somewhere you can find it. I left mine in the downloads folder.

2C) Go to the Privacy & Security tab in Firefox. As of Firefox 109.0 64-bit you do that by clicking the 3 line icon on the upper right hand side of the screen then click in the drop down menu "Settings" and then clicking "Privacy & Security" on the left side of the screen.

-Scroll down to "Certificates" and click "View Certificates".

-Under "Authorities" click "Import" to go to the Certificate Manager.

-Go to where you extracted those DOD CAC Certs (I left it in downloads), enter the folder, and select "Certificates_PKCS7_v5.6_DoD.der.p7b". Then click "Open".

-Check all the boxes to trust DoD Root CA 2 for all the purposes (Trust this CA to identify websites and Trust this CA to identify email users). Click "OK" and then click OK in the Certificate Manager window.

3C) Now we're going to configure Firefox to use your smart card reader. Click "Security Devices" to open the Device Manager.

-Click "Load" type in a Module Name in the field. I typed "OpenSC" in the field but I've seen it suggested to enter "CAC Module" or you can probably leave what the field defaulted to which in my case was "New PKCS#11 Module".

-Now hit "Browse" to the right of the "Module Filename" and find "opensc-pkcs11.so" or if you're a Dual-Use CAC holder you may want to use "onepin-opensc-pkcs11.so". This can probably be found in a couple of places: "/lib/pkcs11/" folder, "/usr/lib64/pkcs11" folder, out loose in the "/usr/lib" folder, but I used the opensc-pkcs11.so in "/lib64/pkcs11/". I think that file in all those (and more) locations are basically the same.

-Click "Open" after you highlighted the opensc-pkcs11.so file. Click "OK", click "OK" on the Device manager window, and leave the settings tab.

-Now go to a DOD CAC enabled website and login with your CAC! Keep in mind that a lot of these websites were set up for Microsoft browsers (Edge,previously Internet Explorer) on Windows OS specifically. You should be able to click some button to move on to the login page. Some of the typical sites are:

https://webmail.apps.mil/mail/ (E-Mail, at least for Army 365 Outlook email anyway)

https://mypay.dfas.mil/ (DFAS MyPay, for your LES)

____________________________________________________________________________
Note: a ".so" is a Shared Object or ".o" which is an "Object" are Dynamic Libraries of the Unix/Linux variety which are dynamically linked at runtime. The Windows equivalent is a Dynamically Linked Library ".dll".

An ".a" file is an Archive file which is a Static Library that is linked by a linker program when compiling. The Windows equivalent is a ".lib".

Some googling can tell you all about that but basically a statically linked library makes a bigger executable file (typically an ".exe" in Windows or a ".bin" Binary file in UNIX/Linux) which are compiled programs. The other kind of programs that can natively be ran in an OS are scripts (".sh" for a Linux Shell or a ".bat" which is a Windows Batch file). Other programs have other kinds of scripts (".py" for Python, ".php" for PHP, ".m" for MATLAB, ".pl" for Perl, etc). Scripted programs can use libraries too.

[RG | <SG> Desloc]

So as I was trying this out on my deck I got held up at the installing of the programs, I had sent you a friend request to to DM you, but I'll just ask here in case anyone else comes along this and encounters my same issue. So i've never used linux before this and thank you for this guide. So my issue is when i'm doing the "sudo pacman -S ccid and opensc. I get the error messages of "failed retrieving file 'ccid-1.4.36-1x86_64.pkg.tar.zst" from steamdeck-packages.steamos.cloud : The requested URL returned error: 404

I'm not sure what i did wrong, but i thought i set it for archlinux with the one command, it can find the file when i do the command but can't download it.

[Smokey the Bear]

I am so close. Got the PCSC to work and identify the card.

Just having issues with the DoD certificates in firefox. When select Security Devices and the psk11.so file comes up with a UNABLE TO ADD MODULE

Any ideas?

[SGtBlackMagic]

I really appreciate you setting up this easy to follow guide. I had this working for a while. After updates I was able to trim the steps needed to get it working again, but for some reason after the last BIG update it is failing at step 3B running pcsc_scan it just keeps spinning and never recognizes the reader or card. I'm not a Linux guru, but I know a good deal about IT. I just don't know what could be wrong. The reader works in other systems, and I tried another good one too. I've tried running through the steps again, and rebooting the deck. All to no avail. My first instinct is scorched-earth - rest the deck and try again, but that seems a bit overkill. Any better ideas?

[Taurion Bruni]

For those that seriously want to do this. If you install Nobara Linux on the steam deck, it will function just like a normal steam deck, but run fedora Linux and has opensc installed by default. You just need to install the certs and you are good to go

[NimrodX]

Booting another distro from sd or usb is probably the best idea for this kind of thing. This not only solves the sc driver software issue but also sandboxes whatever you're doing so that malware installed by something in the game-playing environment won't affect whatever security-sensitive stuff you're connected to (which is still security sensitive even if you're not doing anything security sensitive with it).