Project

General

Profile

Actions
Copy link

Todo #11933

closed
JP VG

PC/SC Smart Card Daemon ``pcscd`` running on all devices at all times, should be optional

Todo #11933: PC/SC Smart Card Daemon ``pcscd`` running on all devices at all times, should be optional

Added by Jim Pingle over 5 years ago. Updated almost 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Viktor Gurov
Category:
IPsec
Target version:
2.6.0
Start date:
05/17/2021
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
22.01
Release Notes:
Default

Description

In 2.5.0/21.02 we added the pcscd service to builds for #9878 and it gets run at startup in all cases to handle certain cryptographic smart cards (e.g. PCKS#11). It consumes resources unnecessarily in the majority of cases where it is not needed. It should be made optional and disabled by default on new installations.

Related issues 2 (1 open — 1 closed)

Related to Bug #12095: Memory leak in pcscdNew06/30/2021

Actions
Related to Bug #12468: Stopping IPsec daemon on the Status / Services page lead to log files flooding if pcscd daemon is enabledResolvedViktor Gurov

Actions

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #1

  • Related to Bug #12095: Memory leak in pcscd added

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #3

  • Status changed from New to Pull Request Review

RB Updated by Renato Botelho about 5 years ago Actions
Copy link
 #4

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Viktor Gurov

PR has been merged. Thanks!

SW Updated by Steve Wheeler about 5 years ago Actions
Copy link
 #5

This option should probably have a warning on it to let users know un-selecting it will restart all IPSec tunnels.

VG Updated by Viktor Gurov about 5 years ago Actions
Copy link
 #6

Steve Wheeler wrote in #note-5:

This option should probably have a warning on it to let users know un-selecting it will restart all IPSec tunnels.

Most of the IPsec Settings restarts all tunnels,
see `$needsrestart` in https://github.com/pfsense/pfsense/blob/master/src/usr/local/www/vpn_ipsec_settings.php

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #7

  • Status changed from Feedback to New

Tested this both on snapshots and on release systems with afcc0e9c97c1993ae6b95f886665fcb4375d26c7 applied via system patches package. The pcscd daemon is no longer running or configured which is great.

The pcscd service still shows up in the service list as stopped rather than being hidden when the option is disabled. We should probably hide when it's not needed that so it doesn't confuse users.

I have not tested PKCS#11 with the option enabled, however. Someone with the appropriate hardware and setup for that will also need to ensure it works before we close this.

VG Updated by Viktor Gurov about 5 years ago Actions
Copy link
 #8

hide pcscd from the service list if not enabled:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/304

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #9

  • Status changed from New to Pull Request Review

VG Updated by Viktor Gurov about 5 years ago Actions
Copy link
 #10

  • Status changed from Pull Request Review to Feedback

Merged

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #11

  • Status changed from Feedback to Resolved

Service is no longer running by default, service is not in the list when disabled.

VG Updated by Viktor Gurov almost 5 years ago Actions
Copy link
 #12

  • Related to Bug #12468: Stopping IPsec daemon on the Status / Services page lead to log files flooding if pcscd daemon is enabled added

JP Updated by Jim Pingle almost 5 years ago Actions
Copy link
 #13

  • Plus Target Version changed from 21.09 to 22.01
Actions
Copy link

Also available in: Atom