Pcscd has to be restarted at every boot to get my SSH keys from my YubiKey

Since about F36 I have to restart pcscd every time to get my keys listed with ssh-add -l. It may have to do with a lock obtained by something else than pcscd (I guess gnupg), and thus fails. Maybe I’m missing something in my ~/.gnupg/scdaemon.conf

I’ve tried all these (also the commented ones):

card-timeout 300
#reader-port Yubico Yubi
#pcsc-driver /usr/lib64/libpcsclite.so.1

But basically the problem is that lock, because the restart of pcscd is what fixes it. Not systemctl --user restart gpg-agent.service, but systemctl restart pcscd.

Does anyone have a better fix? I have a YubiKey 5 NFC.

Related issue, but also no solution:

1 Like

Found the solution here:

~/.gnupg/scdaemon.conf must contain:

pcsc-driver /usr/lib64/libpcsclite.so.1

Of course make sure the path to the pcsc-driver matches. Using rpm -ql pcsc-lite-libs | grep so shows you where it is. The shortest one is often best, it symlinks to the current release.

In my case I could remove the pcsc-driver line, I guess the pcsc-shared option is key.

1 Like

Does it still work when you close and start Firefox again?
It starts new process of scdaemon and breaks gpg --card-status for me.

I think the best solution is to remove the package opensc, which creates conflicts.

I have the following in my .gnupg/scdaemon.conf now:

card-timeout 300
reader-port Yubico Yubi

That last line is maybe not needed. The first line is more of a preference. The disable-ccid is what matters most. I think that’s my most stable solution. Let me know if this works for you, if not I’ll see if more things are needed.

Yes, it works (I mean - removing opensc package), but it is a dirty workaround as I won’t be able to use my Yubikey’s X509 certs in Thunderbird and Firefox anymore.

Any other solutions (in scdaemon.conf) don’t work

That is indeed unstable, reinserting the Yubikey often fixes it (for me). Luckily I don’t need those certs anymore, so for me this fixes it. Doesn’t help you of course.

Works for me on F38

1 Like

Until you open Firefox :slight_smile:

I’ve tried every solution I found. I fixed the problem with uninstalling opensc and installing scute library which should replace opensc in Firefox and Thunderbird (haven’t tested it yet).

1 Like