Pcscd has to be restarted at every boot to get my SSH keys from my YubiKey

Ask Fedora
1

Since about F36 I have to restart pcscd every time to get my keys listed with ssh-add -l. It may have to do with a lock obtained by something else than pcscd (I guess gnupg), and thus fails. Maybe I’m missing something in my ~/.gnupg/scdaemon.conf

I’ve tried all these (also the commented ones):

card-timeout 300
#reader-port Yubico Yubi
disable-ccid
#pcsc-driver /usr/lib64/libpcsclite.so.1

But basically the problem is that lock, because the restart of pcscd is what fixes it. Not systemctl --user restart gpg-agent.service, but systemctl restart pcscd.

Does anyone have a better fix? I have a YubiKey 5 NFC.

Related issue, but also no solution:

1 Like
2

Found the solution here:
https://bugzilla.redhat.com/show_bug.cgi?id=1893131

~/.gnupg/scdaemon.conf must contain:

disable-ccid
pcsc-shared
pcsc-driver /usr/lib64/libpcsclite.so.1

Of course make sure the path to the pcsc-driver matches. Using rpm -ql pcsc-lite-libs | grep so shows you where it is. The shortest one is often best, it symlinks to the current release.

In my case I could remove the pcsc-driver line, I guess the pcsc-shared option is key.

1 Like
3

Does it still work when you close and start Firefox again?
It starts new process of scdaemon and breaks gpg --card-status for me.

4

I think the best solution is to remove the package opensc, which creates conflicts.

I have the following in my .gnupg/scdaemon.conf now:

card-timeout 300
disable-ccid
reader-port Yubico Yubi

That last line is maybe not needed. The first line is more of a preference. The disable-ccid is what matters most. I think that’s my most stable solution. Let me know if this works for you, if not I’ll see if more things are needed.

5

Yes, it works (I mean - removing opensc package), but it is a dirty workaround as I won’t be able to use my Yubikey’s X509 certs in Thunderbird and Firefox anymore.

Any other solutions (in scdaemon.conf) don’t work

6

That is indeed unstable, reinserting the Yubikey often fixes it (for me). Luckily I don’t need those certs anymore, so for me this fixes it. Doesn’t help you of course.

7

Works for me on F38

1 Like
8

Until you open Firefox :slight_smile:

I’ve tried every solution I found. I fixed the problem with uninstalling opensc and installing scute library which should replace opensc in Firefox and Thunderbird (haven’t tested it yet).

1 Like