Secure Setup

OpenCT was designed to be secure by default, and allow system administrators to restrict access to openct in any way. You have the option to

The access control is done via setting permissions on /var/run/openct directory.

Not that in all setups the first user to access a reader will lock that reader, and no other user will be able to access the reader till it is unlocked.

FIXME: how does locking work? does locking work for processes/connections and the build in module limit access to the user (all processes) even without a lock command? Is root able to bypass this security?

OpenCT for everyone

chmod -R 0755 /var/run/openct

Note: this setup is used in the QuickStart documentation.

OpenCT restricted to some group

chgrp -R somegrp /var/run/openct
chmod -R 0750 /var/run/openct

Note: Debian uses this configuration by default, so add any user you want to be able to use smart cards to the scard group.

OpenCT restricte to some user

chown -R someuser /var/run/openct
chmod -R 0700 /var/run/openct

Note: if you use openct with pc/sc-lite, then only pcscd needs to be able to access openct, and all users/application can use it via pc/sc-lite. In this case the restriction to one user is fine. pcscd usualy runs as root.