Knowledge Base
Searching in : Trouble report
ID:TR05T10547
Added on: 2022-05-31
Last Update: 2023-03-13
Solved in version: N/A
Platform: All Platforms
Product: NoMachine Server
Severity: Minor
Status: Solved
Print this article

Cannot use smartcard key authentication inside the session running on a remote node

This Trouble Report has been closed.
Further investigations clarified that the described behaviour is expected and cannot be considered a misbehaviour of the NoMachine software.

 A device forwarded by NoMachine on remote side is intended to operate by NoMachine module which is located at: /usr/NX/lib/libpkcs11.so. NoMachine is not responsible of the local module, for example when using a command like:
$ ssh-add -s /usr/lib64/opensc-pkcs11.so Enter
The NoMachine module should be used instead:
$ ssh-add -s /usr/lNX/lib/libpkcs11.so Enter

Only if the NoMachine virtual desktop has forward authentication enabled in client options, the NoMachine
server allows forwarding the client side ssh-agent and allows client side keys forwarding to server side.
So, command :
$ ssh-add -s /usr/lib64/opensc-pkcs11.so Enter
is valid only for 'forward authentication' option enabled and path /usr/lib64/opensc-pkcs11.so is valid on client side and not on server side.


It's not possible to perform any operation on forwarded smartcard device inside virtual sessions. After connecting smartcard reader in Devices menu and starting ssh-agent inside terminal, all attempts of accessing the reader fail.

Example:

$ ssh-add -s /usr/lib64/opensc-pkcs11.so Enter
passphrase for PKCS#11: Could not add card "/usr/lib64/opensc-pkcs11.so":
agent refused operation

Problem affects virtual desktop sessions regardless of the connection protocol.

 

SOLVED, Released in version N/A