Runtux Blog

This is a step-by-step Howto on installation and usage of the necessary commands to get smartcards or crypto-tokens working on Linux — and on Windows.
Smart card software on Linux consists of a driver for the card reader also called card terminal and a driver for the smartcard or token. There are two projects, OpenSC and MUSCLE. Both projects produce drivers for card terminals (for OpenSC this sub-project is called OpenCT) and for various cards. There are configuration options to make one project see the drivers of the other and vice versa.
I’m using OpenCT (card terminal) and OpenSC (smart card) software because these have worked better for me — except for the pcscd daemon from the MUSCLE project that might be needed for some applications. If you’re using software that depends on a PC/SC interface, you’ll also need to install the pcscd daemon (comes as a debian package).
Manufacturers are continuously improving their smartcards and the applications that run on the card. Up to now this has created an ever-changing pile of middleware to talk to these cards. An idea to improve the situation was a programmable card: Put a Java interpreter on the card and provide applets (so-called “cardlets”) for applications. The idea claims this would improve the situation for middleware on the host. Unfortunately this isn’t quite true: The Java virtual machine on smartcards is subject to change. So we have cards with a recent JVM and old cards with an ancient (1.1 from 2001) JVM. This means the applet needed to make the card work has to be cross-compiled to an older JVM depending on the card used. And there are still a number of host configuration issues.
The situation is worsened by the fact that many manufacturers of smartcards provide cards with their proprietary cardlet in the ROM of the card. This means these cards cannot be used with the applet that matches your middleware. And we’re back to the start and have to write a driver for the proprietary (this time java) middleware as before.
If you’re using Java-based smartcards you need to get a card that can accept a new applet and has the necessary developer keys published. Usually these cards are called “developer version” or similar. You then can use the MCardApplet from the MUSCLE plugins project. I recommend to build the applet yourself — after all this is a security application where your security depends on the software running on the card. There is a section below for preparing a java card with the appropriate applet.
I got the eToken PRO 32k (4.2B) working with OpenSC but not the eToken PRO 72k (Java). The first uses Siemens CardOS, the number in parentheses denotes the version number. Unfortunately these old CardOS based tokens will be discontinued, and Siemens seems to have announced end of life status for its CardOS.
The 72k eToken from Aladdin uses Java and needs a Java applet. The OpenSC project claims that the Java token works with OpenSC, but it didn’t for me. Maybe the token wasn’t a developer version that can accept an applet. The token also didn’t work under windows (although it worked with the Aladdin software there, i.e., I could initialize it) and I had a recent OpenSC binary release for windows from October 2009.
From the OpenSC documentation: “For programmable java cards: the support is for the card with the specific applet – if you have a different applet on your card, it might not be supported.”
First steps for non-Java cards or Java-cards with MCardApplet installed (for installation of the applet, see below):
Install smartcard software and card terminal framework:

apt-get install pcscd opensc libengine-pkcs11-openssl

The following NEW packages will be installed:
  libengine-pkcs11-openssl libp11-0

If your smartcard reader is not supported by pcscd, you should install the openct package in addition to the packages above. You can then run pcscd on top of openct.
After installing these programs, we need to configure pcscd to correctly use our reader. Configure /etc/opensc/opensc.conf to use the pcscd method, search for reader_drivers inside the app default stanza of the config file and modify this to:

reader_drivers = pcsc;

For CCID compatible readers without openct installed, the reader should be visible after plugging in the reader into the USB port:

Readers known about:
Nr.    Driver     Name
0      pcsc       Gemplus GemPC Key 00 00

If the card reader is not directly supported by pcscd (but is supported by openct) we need to configure /etc/reader.conf.d/openct, a config file of pcscd, to use OpenCT as the input method, for this the file should contain:

FRIENDLYNAME     "OpenCT"
DEVICENAME       /dev/null
LIBPATH          /usr/lib/openct-ifd.so
CHANNELID        0

after modifying this file on Debian (on non-Debian systems you’ll probably have to modify /etc/reader.conf directly) we have to run:

update-reader.conf

which creates a new /etc/reader.conf. Now stop and restart openct and pcscd in the following order:

/etc/init.d/pcscd stop
/etc/init.d/openct restart
/etc/init.d/pcscd start

When everything went OK, you should see a pcscd based reader using opensc-tool:

opensc-tool -l

Readers known about:
Nr.    Driver     Name
0      pcsc       OpenCT 00 00

Add user to “scard” group in /etc/group and log in again to have the permissions to access the card. This is necessary if you want to use a reader provided by openct without going through pcscd.
If all else fails, you can still use openct without pcscd and set reader_drivers in /etc/opensc/opensc.conf to:

reader_drivers = openct;

Then a reader should be visible like this:

opensc-tool -l

Readers known about:
Nr.    Driver     Name
0      openct     Aladdin eToken PRO 64k
1      openct     OpenCT reader (detached)
2      openct     OpenCT reader (detached)
3      openct     OpenCT reader (detached)
4      openct     OpenCT reader (detached)

Now we should be able to read the card, if there is only one token in the USB port and no other smartcard readers are installed, we can leave out the -r option (for specifying the reader to use):

cardos-info

3b:f2:18:00:02:c1:0a:31:fe:58:c8:09:75
Info : CardOS V4.2B (C) Siemens AG 1994-2005
Chip type: 123
Serial number: 27 37 c0 09 2b 18
Full prom dump:
33 66 00 45 CB CB CB CB 7B FF 27 37 C0 09 2B 18 3f.E....{.'7..+.
00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
OS Version: 200.9 (that's CardOS M4.2b)
Current life cycle: 32 (administration)
Security Status of current DF:
Free memory : 1024
ATR Status: 0x0 ROM-ATR
Packages installed:
Ram size: 4, Eeprom size: 32, cpu type: 66, chip config: 63
Free eeprom memory: 27686
System keys: PackageLoadKey (version 0xfe, retries 10)
System keys: StartKey (version 0xff, retries 10)
Path to current DF:

1.   Using Java-based Smartcards
Java-based smartcards need some preparation to work with OpenSC. First you should make sure that you have a card that permits you to upload your own applet (cardlet) to the card. This usually means you need a so-called developer version. Avoid cards that have a proprietary manufacturer applet in read-only memory! You also usually need some development keys to upload a cardlet to the card.
For the following instructions I’ve used the Gemalto TOP IM FIPS CY2 (Cyberflex Access 64k v2) which is an old card that has a Java virtual machine version 1.1 from 2001 (!) but the card is well established and will probably be available for some time.
For the card reader I’ve used the Gemalto USB Shell V2 (GemPC Key), a CCID compatible reader. When buying a new reader, you should use one that follows the CCID specification from the PC/SC Workgroup, this ensures that OpenCT will support it. The card reader I’m using can read ID-000 format cards, also called SIM cards. These are small form-factor cards that are nice for authentication purposes. The Cyberflex card I’m using is available in ID-000. If a card isn’t available in ID-000, chances are you can make it fit using a service similar to this SIM cutting service.
Preparing the card for use with OpenSC is a two-step process. The first step is to obtain the necessary applet for the card. The second is to upload the applet to the card and initialize the card with a default PIN. Note that 2048 bit keys may not work with MCardApplet with the current software versions, see Some notes on key sizes.

1.1.   Obtaining the MCardApplet for your card
I recommend building your own version of the applet from source. Get the source code from svn://svn.debian.org/muscleplugins/trunk/MCardApplet using the source code control tool subversion:

svn co svn://svn.debian.org/muscleplugins/trunk/MCardApplet

I had to make several changes to use Java 1.6 for cross-building for the ancient Java VM that runs on the card. My Cflex.properties looks like this:

CARD_NAME=Cflex
JAVA_BUILD_HOME=/usr
JC_HOME=${basedir}/depends/jc212
API_JAR=${JC_HOME}/lib/api21.jar
API_EXPORT_FILES=${JC_HOME}/api21_export_files
CAPTRANS=${basedir}/depends/jc212/bin/captransf.jar
VM_SOURCE_VERSION=1.2
VM_TARGET_VERSION=1.1
BOOTCLASSPATH=${basedir}/depends/jdk1.2.2/depends/jdk1.2.2/lib

In particular, I’m using the native java environment installed on debian lenny. This lives in /usr. Otherwise you should follow the excellent building instructions in the file INSTALL. Then I’ve modified the javac in the target named compile in the common.xml ant build file as follows:

<target depends="precompile" name="compile">
    <mkdir dir="${OUTPUT_DIR}"/>
    <javac debug="on"
        verbose="on"
        fork="true"
        executable="${JAVA_BUILD_HOME}/bin/javac"
        srcdir="${APPLET_SRC}"
        destdir="${OUTPUT_DIR}"
        target="${VM_TARGET_VERSION}"
        source="${VM_SOURCE_VERSION}">
        <bootclasspath>
            <pathelement location="${BOOTCLASSPATH}"/>
        </bootclasspath>
        <classpath>
            <pathelement location="${API_JAR}"/>
            <pathelement location="."/>
            <pathelement path="${java.class.path}"/>
        </classpath>
    </javac>
</target>

I’ve added the target and source options. These refer to the specific java virtual machine version we’re cross-building for. I’ve also added the bootclasspath to get the classes that are VM specific from the old java development package.
This allows me to cross-build the applet for an old version of the java virtual machine without running the old java development environment which does no longer run on recent versions of Linux due to library incompatibilities.
I also had to change all the backslashes in common.xml to forward slashes. It looks like the java compiler can handle the backslashes in path names, but the other tools cannot.
Before building you should also look through CflexCapabilities.properties for any capabilities you want to enable which are not enabled in the default configuration. I had to enable -DWITH_RSA_2048 and -DWITH_SIGN for example.
For the impatiant I’m offering a pre-compiled version of the applet. I’ll update this text with the build instructions soon.

1.2.   Uploading the applet to the card
As a preparation for this step, you should install the pcsc daemon and the pcsclite development packages on debian:

apt-get install pcscd libpcsclite-dev

For uploading the applet to the card, I recommend using gpshell, a tool from the globalplatform project which depends on the globalplatform library. Unfortunately these are not yet packaged as Debian packages, so obtain the sourcecode to both, gpshell and the globalplatform library . Unpack these packages and build using the normal process:

./configure
make
make install

For the globalplatform library you need the development libraries for libpcsclite, available as the Debian package libpcsclite-dev which should be installed before the ./configure step above.
If you installed the globalplatform library without root privileges, you have to run ldconfig as root to make the new library available in the shared library cache.
Check that your smartcard services are running (see above for how to do that) and verify that you see your card reader (or token) using:

opensc-tool -l

The gpshell tool interfaces to the card via pcscd, so you should see something similar to the following:

Readers known about:
Nr.    Driver     Name
0      pcsc       Gemplus GemPC Key 00 00

Now we can proceed to upload the applet using gpshell. We need the following applet upload gpshell script, put this into the file applet_install.gpshell, note that lines terminated with “\” need to be concatenated, gpshell currently doesn’t understand continuation lines:

enable_trace
establish_context
card_connect
select -AID a000000003000000
open_sc -security 1 -keyind 0 -keyver 0 \
   -mac_key 404142434445464748494a4b4c4d4e4f \
   -enc_key 404142434445464748494a4b4c4d4e4f
delete -AID a00000000101
delete -AID a000000001
delete -AID a0000003230101
delete -AID a00000032301
install_for_load -pkgAID a000000001 -nvCodeLimit 16000 \
   -sdAID a000000003000000
load -file CardEdgeCflex.ijc
install_for_install -instParam 00 -priv 02 -AID a00000000101 \
   -pkgAID a000000001 -instAID a00000000101 -nvDataLimit 32000
card_disconnect
release_context

and run the script with gpshell:

gpshell applet_install.gpshell

Finally we will have to set a default PIN for the card using opensc-tool:

opensc-tool -s 00:A4:04:00:06:A0:00:00:00:01:01 -s \
B0:2A:00:00:38:08:4D:75:73:63:6C:65:30:30:04:01:08:\
30:30:30:30:30:30:30:30:08:30:30:30:30:30:30:30:30:\
05:02:08:30:30:30:30:30:30:30:30:08:30:30:30:30:30:\
30:30:30:00:00:17:70:00:02:01

This sets the PIN to eight zeros, “00000000″. After this procedure the card can be used like a normal PKCS#15 based card with OpenSC.

1.2.1.   Some notes on using the gpshell script with other cards
Many of the magic numbers in the gpshell script depend on the card in use and on the applet that is uploaded. An AID is an applet-ID. The open_sc command has nothing to do with OpenSC, but opens a secure channel to the card. The parameters are the developer keys of the card. In our example, the key is used twice and the hex-bytes denote the string:

@ABCDEFGHIJKLMNO

The AID used for the secure channel is different for other brands of cards. I was able to find out this AID using the following AID gpshell script:

enable_trace
establish_context
card_connect
open_sc -security 1 -keyind 0 -keyver 0 \
   -mac_key 404142434445464748494a4b4c4d4e4f \
   -enc_key 404142434445464748494a4b4c4d4e4f
get_status -element 80
card_disconnect
release_context

This displays for the Gemalto TOP IM FIPS CY2:

List of applets (AID state privileges)
a000000003000000        7       0

The delete commands remove older versions of the applet — there also was a version that had another applet ID — from the card before uploading the new version. Think of the applet living in a package named a000000001 and the applet named a00000000101. The install_for_load command establishes the package inside the a000000003000000 package. Then the install_for_install command installs the applet into non volatile memory after upload.
Note that these numbers are hard-coded into the applet that is being uploaded. This is defined during compile-time and for the MCardApplet this can be configured in the common.xml ant-file. When packaging the compiled java classes, the build process generates .cap files which contain the applet ID in binary format, notably the Applet.cap file contains the AID of the applet.
So if these numbers are changed when building a custom applet, be sure to adapt the upload commands, too. A warning here: All tools that depend on the MCardApplet expect the given AID, so changing the AID would incur a change of all tools or at least their configuration.

2.   OpenVPN Preparation: Step by step process with high-level tool
This section describes how to initialize a token, create a user key and certificate using tools that come with OpenVPN. This was only tested on Linux since the certificate handling scripts for OpenVPN are more advanced on Linux.
I had to patch the pkitool of OpenVPN to use the pkcs15-init command instead of the pkcs11-tool command for initializing the token and creating keys. The reason is that Aladdin limits their tokens to use one key for only one purpose (encryption or signing). The pkcs15-init command allows the specification of the key purpose while the pkcs11-tool command does not.
In the following we assume you are in the easy-rsa directory of OpenVPN, and you have initialized the configuration by reading the configuration in vars. It’s also always a good idea to have a backup of all the OpenVPN keys before starting.
Initializing the token for first use (or re-using an already formatted token) THIS DESTROYS ALL DATA ON THE TOKEN:

./pkitool --pkcs15-init 0 "Thomas Mustermann"

New User PIN.
Please enter User PIN:
Please type again to verify:
Unblock Code for New User PIN (Optional - press return for no PIN).
Please enter User unblocking PIN (PUK):
Please type again to verify:

If the token was already initialized, the procedure would also ask for the old password.
Now we can check that everything worked, by looking at the PINs:

pkcs15-tool --list-pins

Now we can proceed to generate a key pair and a certificate, this takes a long time:

./pkitool --pkcs15 /usr/lib/opensc-pkcs11.so 0 45 "user cert" client27

When everything went OK, we should be able to display keys, public keys, and certificates on the token:

pkcs15-tool --list-keys
pkcs15-tool --list-public-keys
pkcs15-tool --list-certificates

3.   What is needed for Windows
I’ve first installed the latest OpenVPN installer, only this package has the necessary TAP network driver for Linux. Only the TAP driver needs to be installed.
I’ve used a compiled version of OpenVPN that comes bundled with OpenSC from the binary windows repository, I’ve used the latest

opensc-i686-w32-mingw32-007-*.*

files (from Oct 2009). For 64bit Windows (AMD64) the

opensc-x86_64-pc-mingw32-003*.*

files should be used. Everything unpacked from these files should be installed to

C:\Programs\OpenVPN

I’ve also created a configuration directory under that directory called config. In config there are the necessary certificates (root ca) and hash keys and the client.ovpn configuration file.
When using my OpenVPN admin script, Python for windows from python.org and the Python WIN32 package are needed. In addition my rsclib library needs to be installed. For installing rsclib, unpack the .zip file and run:

setup.py install

from a command prompt. The admin script in pyovpn.zip has the same installation procedure.
After installing everything, basic working of the smart card can be verified with the OpenSC tools:

opensc-tool -l
cardos-info
pkcs15-tool --list-certificates

3.1.   Aladdin Token
For using the Aladdin eToken with Windows, the smart card tools of the manufacturer have to be installed — these include the driver for accessing the tokens. I’ve used:

PKIClient-x32-5.00.msi

from

eToken PKI Client 5.0 SP1 Windowsx32.zip

3.2.   Gemalto USB Shell Token V2
The driver for the Gemalto USB Shell Token reader can be downloaded free of charge from the Gemalto website.

4.   Using OpenVPN with SmartCard
OpenVPN uses a PKCS#11 provider library, on Debian this is /usr/lib/opensc-pkcs11.so, to access the smart card. We can show which certificates are on the card by issuing:

openvpn --show-pkcs11-ids /usr/lib/opensc-pkcs11.so

The following objects are available for use.
Each object shown below may be used as parameter to
--pkcs11-id option please remember to use single quote mark.

Certificate
      DN:             /C=AT/ST=AT/L=Weidling/ ...
      Serial:         03
      Serialized id:  OpenSC\x20Project/PKCS\x20 ...

Now OpenVPN can be started with the smartcard. I’m using the following additional config entries for OpenVPN — pkcs11-providers is set to the path of the PKCS#11 provider library:

pkcs11-providers "/usr/lib/opensc-pkcs11.so"
pkcs11-id-management
management 127.0.0.1 4711
management-query-passwords
management-hold

For Windows the provider library becomes (assuming the OpenSC tools where installed to C:ProgramsOpenVPNbin):

pkcs11-providers "C:\\Programs\\OpenVPN\\bin\\opensc-pkcs11.dll"

The other parameters are the same as for other operating systems.
Note also that the askpass option of OpenVPN does not work for querying the token password. In my experiment I had to give the token password to OpenVPN via the management interface using the config option management-query-passwords.
This configuration tells OpenVPN to open the management interface on Port 4711 of localhost. It will ask for the passphrase of the Aladdin token on that port. Additionally we wait (management-hold) until a management program has opened the management interface and told OpenVPN to proceed.
The pkcs11-id-management tells OpenVPN to accept the pkcs11-id to use via the management interface. With a little intelligence in the management interface we can avoid having the pkcs11-id in the configuration file (which would then be different for each user).
OpenVPN can be asked via the management interface about a listing of all pkcs11-ids. If there is only one certificate on the card, we feed the id of the only certificate back to OpenVPN when it asks about the pkcs11-id. This can be done without user intervention.
Unfortunately the feature that OpenVPN can ask the smartcard for all the certificates depends on the Token being present when OpenVPN is started. An alternative is to specify the pkcs11-id` directly in the configuration file. If this is specified, the management interface will ask for the token if it isn’t present when starting OpenVPN. The parameter to the pkcs11-id config parameter is the Serialized id from the command output above.
Since I have not found any graphical user interface programs for OpenVPN that can deal with asking the user for the token passphrase, I’ve written a little command-line python script which can be run on both, Windows and Linux, and will ask the user to insert the token and specify the token passphrase.
OpenVPN can be started with the script by issuing the command:

pyovpn

in a command prompt window. The command will start openvpn and proceed to ask for necessary token passwords.

4.1.   Low-level usage of the management interface
With the management-query-passwords option, OpenVPN will ask the password from the management interface. After starting the OpenVPN daemon and connnecting to the managment interface on the defined port (e.g., using telnet) we see the following message:

>INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
>PASSWORD:Need 'OpenSC Card (New User) token' password

The password can then be entered using the password command of the managment interface:

password 'OpenSC Card (New User) token' sehrgeheimespasswort

OpenVPN answers with:

SUCCESS: 'OpenSC Card (New User) token' password entered, but not yet verified

5.   Key Revocation
Revoke a certificate:

openssl ca  -config $KEY_CONFIG -revoke keys/02.pem

(re-) generate key revocation list (CRL):

openssl ca  -config $KEY_CONFIG -gencrl -out keys/crl.pem

6.   OpenVPN Preparation: Step by step process with low-level tools
This section describes the low-level tools as used by the patched pkitool from OpenVPN. It does not create a certificate with OpenSSL. This is for documentation purposes only (to understand what goes on behind the scenes) and was my first approach to getting started with OpenSC.

• Erase the card — if you already have a Security Officer PIN installed, you need this for erasing the card:

  
  pkcs15-init -E
  

• Create PKCS#15 structure (option –no-so-pin specified not to create security officer PIN and user PUK) on the card — note that the keys need to be between 6 and 8 characters long and should be numeric if you intend to use a keypad for key-entry (which applies mostly to smartcards not to USB tokens). Also note that if you omit –no-so-pin you should keep the Security Officer PIN secure — only with it can the token be re-formatted:

  
  pkcs15-init --create-pkcs15 --no-so-pin
  

  New Security Officer PIN (Optional - press return for no PIN).
  Please enter Security Officer PIN:
  Please type again to verify:
  Unblock Code for New User PIN (Optional - press return for no PIN).
  Please enter User unblocking PIN (PUK):
  Please type again to verify:
  

• The steps above can be rolled into one command:

  
  pkcs15-init -E --create-pkcs15 --no-so-pin
  

• Add an authentication (user) ID to the token with corresponding PIN and PUK:

  
  pkcs15-init --store-pin --auth-id 01 --label "User Name"
  

  New User PIN.
  Please enter User PIN:
  Please type again to verify:
  Unblock Code for New User PIN (Optional - press return for no PIN).
  Please enter User unblocking PIN (PUK):
  Please type again to verify:
  

• Check that everything worked, by looking at the PINs:

  
  pkcs15-tool --list-pins
  

  PIN [Security Officer PIN]
      Com. Flags: 0x3
      ID        : ff
      Flags     : [0xB2], local, initialized, needs-padding, soPin
      Length    : min_len:6, max_len:8, stored_len:8
      Pad char  : 0x00
      Reference : 1
      Type      : ascii-numeric
      Path      : 3f005015
  
  PIN [User Name]
      Com. Flags: 0x3
      ID        : 01
      Flags     : [0x32], local, initialized, needs-padding
      Length    : min_len:4, max_len:8, stored_len:8
      Pad char  : 0x00
      Reference : 3
      Type      : ascii-numeric
      Path      : 3f005015
  

• Now we can generate an RSA key on the card. Note that we could also import a PKCS-12 key onto the card, but the more secure option is to let the card generate the key (so the key will never be available outside the card). The split-key option actually generates two key-pairs, one for encryption and one for signing. There are some labelling options to attach names to the generated keys but these aren’t needed if you want only one key. You could specify an application profile with the –id option, if this isn’t given the default ID 45 (authentication purposes) is used. The command will ask for the Security officer PIN, then for the User PIN, then again for the Security officer PIN (!):

  
  pkcs15-init --generate-key rsa/2048 --auth-id 01 --split-key
  

  Note that with Java smartcards the keysize 2048 might not work with the current version of the tools, see Some notes on key sizes.

• Now we can verify that the key was actually stored on the card:

  
  pkcs15-tool --list-keys
  

  Private RSA Key [Private Key]
      Com. Flags  : 3
      Usage       : [0x4], sign
      Access Flags: [0x1D], sensitive, alwaysSensitive, neverExtract, local
      ModLength   : 2048
      Key ref     : 16
      Native      : yes
      Path        : 3f005015
      Auth ID     : 01
      ID          : 45
  

• List public keys:

  
  pkcs15-tool --list-public-keys
  

  Public RSA Key [Public Key]
      Com. Flags  : 2
      Usage       : [0x4], sign
      Access Flags: [0x0]
      ModLength   : 2048
      Key ref     : 0
      Native      : no
      Path        : 3f0050153048
      Auth ID     :
      ID          : 45
  

• For the following steps we will need a minimum openssl config file:

  
  openssl_conf            = openssl_init
  
  [ openssl_init ]
  engines                 = engine_section
  
  [ req ]
  default_bits            = 2048
  default_keyfile         = privkey.pem
  distinguished_name      = req_distinguished_name
  
  [ req_distinguished_name ]
  countryName                     = Country Name (2 letter code)
  countryName_default             = AT
  countryName_min                 = 2
  countryName_max                 = 2
  stateOrProvinceName             = State or Province Name (full name)
  stateOrProvinceName_default     = Austria
  localityName                    = Locality Name (eg, city)
  localityName_default            = Vienna
  0.organizationName              = Organization Name (eg, company)
  0.organizationName_default      = example.com
  organizationalUnitName          = Organizational Unit Name (eg, section)
  organizationalUnitName_default  = IT-Department
  commonName                      = Common Name (eg, server\'s hostname)
  commonName_max                  = 64
  emailAddress                    = Email Address
  emailAddress_max                = 40
  
  [ engine_section ]
  pkcs11 = pkcs11_section
  
  [ pkcs11_section ]
  engine_id = pkcs11
  dynamic_path = /usr/lib/engines/engine_pkcs11.so
  MODULE_PATH = /usr/lib/opensc-pkcs11.so
  init = 0
  

• Generate a certificate request (CSR) from this key using openssl:

  
  CLIENT=newclient
  openssl req -days 3650 -new -out $CLIENT.csr -config openssl.cnf \
    -engine pkcs11 -keyform engine -key 0:45 -sha1
  

  This will ask for all the certificate parameters. Alternatively these can be specified using the -subj option of openssl (this is broken into several lines but should be assembled into one line) with the following parameter:

  /C=AT/ST=Austria/L=Vienna/O=example.com/OU=IT-Department
  /CN=$CLIENT/emailAddress=user@example.com
  

• You can view the contents of the CSR using:

  
  openssl req -in $CLIENT.csr -noout -text
  

• Now sign the certificate request with whatever tools you are using. With the pkitool of OpenVPN this would become (after having copied the certificate request newclient.csr to the keys directory):

  
  pkitool --sign newclient
  

  The message about not being able to access newclient.key can be ignored.

• You may want to delete old certificates from the token:

  
  pkcs15-init --delete-objects cert --id=45
  

• Then import the new certificate onto the token:

  
  pkcs15-init --store-certificate newclient.crt --id=45
  

• Reading a certificate from the token and output with openssl:

  
  pkcs15-tool --read-certificate 45 | openssl x509 -noout -text
  

6.1.   Some notes on key sizes
Using 2048 bit keys should generally be possible with newer cards. I had some problems with these key sizes using my Java smartcard, though.
After uploading the applet to the card, it is possible to create a key with either 1024 or 2048 bit. This indicates that the card is able to handle the large keysize. When trying to generate a CSR using openssl the command failed with:

[opensc-pkcs11] iso7816.c:99:iso7816_check_sw: No precise diagnosis
[opensc-pkcs11] muscle.c:745:msc_compute_crypt_process: returning with:
                Card command failed
[opensc-pkcs11] muscle.c:840:msc_compute_crypt: returning with:
                Card command failed
[opensc-pkcs11] card-muscle.c:749:muscle_compute_signature:
                Card signature failed: Card command failed
[opensc-pkcs11] sec.c:53:sc_compute_signature: returning with:
                Card command failed
[opensc-pkcs11] pkcs15-sec.c:273:sc_pkcs15_compute_signature:
                sc_compute_signature() failed: Card command failed
20808:error:0E06D06C:configuration file routines:NCONF_get_string:no value:
conf_lib.c:329:group=req_attributes name=unstructuredName_min
20808:error:0E06D06C:configuration file routines:NCONF_get_string:no value:
conf_lib.c:329:group=req_attributes name=unstructuredName_max
20808:error:8000A005:Vendor defined:PKCS11_rsa_sign:General Error:
p11_ops.c:97:
20808:error:0D0C3006:asn1 encoding routines:ASN1_item_sign:EVP lib:
a_sign.c:276:

Worse, after reinitializing the card in this state with:

pkcs15-init -E --create-pkcs15 --no-so-pin
pkcs15-init --store-pin --auth-id 01 --label "User Name"

and trying to generate a smaller key, this fails with:

pkcs15-init --generate-key rsa/1024 --auth-id 01 --split-key

[pkcs15-init] iso7816.c:102:iso7816_check_sw: Unknown SWs; SW1=9C, SW2=03
[pkcs15-init] muscle.c:557:msc_generate_keypair: returning with:
              Card command failed
[pkcs15-init] card.c:678:sc_card_ctl: returning with:
              Card command failed
[pkcs15-init] pkcs15-muscle.c:272:muscle_generate_key:
              Unable to generate key
[pkcs15-init] pkcs15-muscle.c:273:muscle_generate_key: returning with:
              Card command failed
Failed to generate key: Card command failed

I was able to fix this by re-downloading the applet onto the card. This also happens the other way round, when generating a 1024 bit key first and trying — after reinitializing the card with pkcs15-init — to generate a 2048 bit key.
So I recommend to stick with 1024 bit keys with the current software versions (debian lenny).

I’m currently at the media ecologies conference in manchester, UK. I was just talking about what tools and interfaces we need for collaboration tools (on the web). This also rehashes some of the ideas in my blog entry on cloud computing and the problems with (lack of) openness of cloud applications. The slides of my talk can be downloaded from my website.

Ronja, the optical data link device, is often cited as a failed open source hardware project — the last one mentioning it I just read is Lawrence Kincheloe’s excellent essay Musings Upon the Nature of Open Source Hardware as a Business at the end of his project visit summary at Factor e Farm.
Roja did fail (in the sense that it isn’t very widespread today not in the sense of being a cool open source project). One of the research studies I know of is the presentation “Ronja — Darknet of Lights” by Johan Söderberg at the 4th Oekonux conference for which Audio is available. The study is very interesting although I don’t agree with the conclusions. So why did Ronja “fail”?
Ronja’s main application was cheap internet access. At the time of its design in 2001 wireless LAN (Wifi) wasn’t yet available cheaply. And in the Czech Republic DSL wasn’t available at the time.
Now consider the technical characteristics of Ronja:

• Up to 10MBit/s
• Up to 1.4 km range
• Light: Doesn’t work in fog, or other bad weather (snow)
• Light: Hard to get the beam to the destination (direction)
• Light: Interference with daylight
• For full-duplex communication we need two (receiver + transmitter) devices
• sold for around 700$ at the time (the LED alone cost 120$ you get these for .75$ now)
• needed “a hell of a lot of time to build one” according to Söderberg

And compare these with WLAN:

• Up to 54MBit/s
• With good antennas several km range (I’ve built a link with 5.5km)
• Antennas are cheap and can even be built at home, e.g., a Cantenna — you can build a cantenna in an evening
• Works in fog and bad weather
• we need only one antenna at sender and one at receiver
• WLAN is very cheap nowadays, it became available (with new frequencies) in 2005 in cz.

So I think that Ronja “failed” because it was replaced by something better and cheaper that was readily available. It isn’t an example of a failed open source business model for hardware and shouldn’t be used as an example. This doesn’t mean that we already know how a business model for open source hardware should look like, though.
The idea behind Ronja — according to the Wikipedia article on Ronja “User Controlled Technology” is (mostly) achieved with WLAN technology today: We can use cheap devices and modify them (using open source firmware and homegrown antennas) to suit our needs. And there are large wireless communities now like Funkfeuer in Vienna who do their own Internet communication.

[Dies ist der Abstract meines Vortrags am Linuxwochenende im Metalab, die alte Version des Abstracts ist inzwischen von der Linuxwochen Homepage verschwunden...]

PGAPy ist ein Python-Wrapper für PGAPack, eine der vollständigsten Bibliotheken für genetischen Algorithmen. Die Python-Bibliothek eignet sich für eigene Experimente mit genetischen Algorithmen, aber auch für die Implementierung von kompletten Anwendungen.

Der Vortrag gibt eine kurze Einführung in genetischen Algorithmen mit Beispielen in Python. Vorgestellt wird u.a. ein Programm zum automatischen Erzeugen der bekannten Sudoku Zahlenrätsel. Dabei wird schrittweise die Bewertungsfunktion für ein Sudoku entwickelt.

Dieses Wochenende ist wieder Linuxwochenende im metalab, ich werde wieder einen Vortrag zu Open Money halten, ausserdem einen Lightning-Talk zu Generierung von Morse-Code als MIDI-Datei (was für einige Anwärter auf die Amateurfunklizenz vielleicht interessant ist, auch wenn das Code-Requirement inzischen gefallen ist.)

Cloud Computing is becoming increasingly popular — and it is a danger to your freedom. But we can do something about it.
First, when the term Cloud Computing was introduced, it meant a set of low-level services like virtual machines, databases and file storage. Examples of these are Amazon Elastic Computing Cloud and related services. Since these services are quite low-level, they can be replicated by others, an example is the Eucalyptus project.
This means if you aren’t satisfied with the service one cloud computing provider offers, you either can change the provider or — e.g., using Eucalyptus — roll your own.
But increasingly cloud-computing is a relaunch of the old Software as a Service paradigm under a new name. This means that applications like Textprocessing, Spreadsheets, Wiki, Blog, Voice and Video over IP, collaboration software in general is made available as so-called “Web 2.0″ applications — now called “Cloud Applications” on the web.
When using these services, there is a severe risk of Vendor Lock-In — since the applications may not be available elsewhere, you cannot easily switch the provider. Worse: From some of the Web 2.0 Services like social networks (e.g., Xing, LinkedIn, Facebook) you can’t retrieve your own data. Xing for example has a “mobile export” for data, but this works only for paying customers and only exports address data.
And people have started to realize — e.g., in this facebook group — that multiple incompatible applications — escpecially in the social network sector — puts a large burdon on customers to update multiple personal profiles on multiple sites.
But although it has been noted by the Free Software and Open Source community (e.g., in an interview with Richard Stallman and by Eric S. Raymond in his blog) it has not been widely recognized that cloud computing or software as a service — in particular in the form called “Web 2.0″ — creates a vendor lock-in worse than for proprietary software.
For your social networks this may mean that when you retrieve your data (remember, you helped them build that data!), the social network may throw you out as it happened in that case mentioned by Henry Story and later updated here.
The solution to this problem? Don’t get trapped in a data silo. This may still mean that there can be software as a service offerings. But the software needs to be free (as in free speech). So we can still switch to another provider or decide to host our own service.
But companies won’t do it for us. As Doc Searls notes in Silos End: “These problems cannot be solved by the companies themselves. Companies make silos. It’s as simple as that. Left to their own devices, that’s what they do. Over and over and over again.”
So this can only change if customers make and demand the change. A good rule-of-thumb for software as a service is on the page of the Open Cloud Initiative in the article The four degrees of cloud computing openness. While being a customer of a closed/proprietary cloud with “no access” is clearly a bad idea, open APIs and formats don’t work too well — you don’t have the software to work with your data. So the only valid options that remain are Open APIs, Open Formats and Open Source, and in some cases Open Data.
Still most web applications — like most social network software — are of the completely closed type. There are no open formats and no open APIs. So check your dependencies: What web-applications are you depending on and what is their degree of cloud computing openness?
A word on the license to guarantee openness in cloud-computing. As mentioned in the above-cited interview with Richard Stallman, the GNU General Public License is not enough to keep software in a cloud open. The cloud provider could take the software, make own modifications (which you will depend upon) and not release the modified software to you as a customer. Again you have a vendor lock-in. To prevent this, the GNU Affero General Public License has been designed that prevents closed-source modifications to hosted applications.
Finally, for all sorts of social software — not just social network software but everything that creates more value for more people, usually by linking information — should follow a distributed peer-to-peer approach. We don’t want this data to be a siloed application hosted by a single company. And if there are multiple companies hosting the data we already see the problem with multiple social network providers.
So we need standards and distributed protocols. And the implementation should follow a peer-to-peer approach — like seen in filesharing applications today — to make it resilient to failure and/or take-down orders of hostile bodies (like, e.g., some governments). Lets call this “Web 3.0″.
Examples of such social software are of course the social network sector. We already have a distributed protocol for social networking based on the Friend of a Friend Semantic Web Ontology. With this approach everyone can publish his social networking data and still be in control of who can see what. And the data is under user-control, so it’s possible to remove something.
Another example of social software is probably Money (in the sense of micro- or macro payments in the net). Thomas Greco in the book The End of Money and the Future of Civilization asks for separation of money and the state. A future implementation of money may well be based on a peer-to-peer social software implementation.
These social software needs security solutions. We want to model trust-relationships. Parts of the puzzle are probably OpenID and a newly-proposed scheme by Henry Story called FOAF+SSL mainly used for social networking 3.0 but probably very useful for other social software solutions.
So lets work on solutions for the future.

Seit einiger Zeit bekommt man von Inode/UPC einen automatischen Nameserver (DNS) zugeteilt der bei offensichtlichen Tippfehlern (wenn ein Benutzer sich beim Namen einer Webseite verschreibt) eine Werbe- und Suchmaschine von UPC zurückliefert — statt dem Benutzer mitzuteilen, dass es diese Domain nicht gibt.

Diese Verhalten eines der wichtigsten Services im Internet — der Namensauflösung — verletzt klar die Netzneutralität wie auch schon im Jahr 2007 von Ed Felten in seinem Blog im Falle Verizon festgestellt wurde. Verizon hat wohl seither auf diese Praxis — nach vielen Protesten — wieder verzichtet. Berechtigterweise wurde UPC für diese Praxis für den Big Brother Award nominiert — die gesammelten Daten gehen offensichtlich an einen ausländischen Werbeunternehmer. Zumindest in einem Fall kommt es bei diesem Verhalten zu Probleme bei Telefonie im Internet wie einem Forum Posting zu entnehmen ist.

Schlimmer noch: UPC liefert falschen Information auch für Domains die ganz klar von jemand anderem reserviert sind. Wenn ich also nonexistent.source-forge.org ansurfe komme ich auch auf die Werbeseite von UPC — obwohl source-forge.org (ja mit Bindestrich) von dem grossen Open Source Projekthoster sourceforge reserviert ist. Hoffentlich lässt es da mal jemand auf ein Gerichtsverfahren wegen unlauterem Wettbewerb ankommen. Wäre vermutlich recht lukrativ, jedenfalls bei anderen Firmen als Sourceforge.

Mir war das bisher nicht aufgefallen, aber offensichtlich wurden ehemalige Inode-Kunden erst vor kurzem umgestellt, UPC-Telekabel Kunden offensichtlich schon früher.

Heute habe ich mich bei der UPC-Hotline beschwert. Man werde an dem Fall arbeiten und “den Fehler” beheben. Leider könne man mir keine Ticket-Nummer geben unter welcher ich meine Beschwerde nochmal urgieren kann — aber ich könne ja “in einigen Tagen” wieder anrufen. Ein Rückruf wurde mir versprochen, mal sehen ob da was kommt. Ich habe den Hotline-Bearbeiter freundlich darauf hingewiesen, dass es sich ja nicht um einen unbekannten Fehler handeln kann, wenn UPC dafür bereits für den Big Brother Award nominiert wurde.

Inzwischen habe ich einen Workaround gefunden: UPC hat die alten, funktionierenden Nameserver nicht abgeschaltet, in obigem Link des ip-phone-forums findet man funktionierende DNS-Server: 195.34.133.25 und 195.34.133.26 die man fix einstellen kann. Weitere Tips finden sich als Antwort auf mein Posting an die LUGA-Mailingliste. Die alternative ist, gleich einen eigenen Nameserver zu betreiben (unter Linux sehr einfach möglich) oder auf alternative Namenshierarchien umzusatteln wie z.B. opennicproject — auch wenn man bei Verwendung von Alternativen von einer deutschen Ministerin gleich als pädophil eingestuft wird. Es ist kaum zu glauben, was manche Politiker für einen Schwachsinn von sich geben.

I recently needed to recover data from a “dead” notebook. The only hardware I had available that had a connector for an ATA notebook harddisk was my Soekris net4801. This device doesn’t have VGA on board, so we need to boot GRML with a serial console. First I was unable to get GRML to correctly start a getty process. Meanwhile I’ve found out that the recipe in issue485 of the GRML-Bugtracker does the trick (I’ve modified the console speed to the speed I’m using in the Soekris bootloader):

grml console=tty 1console=ttyS1,38400n8

I had tried console=ttyS1,38400n8 before which doesn’t work. So I added the ssh= boot-options found out via the grml cheatsheet. I could ping the machine but no SSH. Turns out it takes a loooong time until grml starts up the ssh-daemon for two reasons

• The net4801 is really slow
• GRML creates new SSH Host-keys before starting up SSH. Thats good. But a newly-started box without a Keyboard has a really small random-number pool, so the box sits there waiting for randomness to happen for generating the keys. So it helps to run several parallel pings to the machine to create some network traffic the timing of which slowly fills the randomness pool …

Turns out that process took several minutes on the Soekris net4801. After waiting I was finally able to log into grml and rescue the data using ddrescue. Thanks GRML!

On April 9 I blogged here some firmware bugs of the Beronet bero*fos failover switch. They now have a new firmware 1.3.5 — a little over two weeks after reporting the bug with easter holidays in between. I’ve not had time yet to test this but wanted to blog this as an example of good support. I’ll blog the test results when I’ve had time to test the device with the new firmware.

Update 2009-04-27: There is a new firmware: good support from beronet
Update 2009-04-10: I’ve written a config-utility for the device, available in my rsclib on sourceforge (in python)

I’m now experimenting with the Beronet bero*fos failover switch. I need this for a project where two redundant asterisks should be switched by the bero*fos.
To get the following into proportion: I’m a customer of Beronet and usually like their products. But selling a device for around 700.- Euro we should expect working firmware and working configuration software. Especially since the device sits at a crucial point from a safety point of view: it’s used in scenarios where we want failover capabilities for telephone equipment.
The config-software is open source, so we can work around it’s shortcomings. But there is a firmware bug, setting some configuration variables via web interface has side-effects on other configuration variables. (we can work around that by writing our own config program). So I’d really like a more open design here: I’m voting for open firmware and a hardware documentation. But that might lead to others building the device for less money…
I would also prefer a documentation of the parameter interface in addition to (or instead of) a configuration program. Integrating the device into other infrastructures where we don’t want a binary configuration program requires reverse-engineering. I’ve done that in the following.
In the following I’m referring to berofos Firmware 1.3.3 which is the latest on Beronets webpage and in my device. The berofos tools for Linux on the webpage were apparently last updated in December 2007 and don’t have a version number.
The device has four groups of 4 ports each, A, B, C, D. These can be switched in two scenarios, a fallback scenario, which can connect A-B or A-D and a bypass scenario which can connect A-B and C-D or A-D. The first scenario is useful if there are redundant devices where one device can replace another (e.g. as in our scenario with two asterisk boxes), the second scenario is useful when you have an asterisk connected in between the telephone network and an old PBX. In case the asterisk fails, the PBX can be directly connected to the telephone network.
I won’t rehash the features and documentation of the device here, the berofos docs and tools page has a link to the manual (and to the command-line tool for both, Linux and Windows).
The device has a web-interface and a command-line interface written in C under the GPL version 2 license without a version-upgrade clause. The individual source files refer to a LICENSE file which isn’t included in the distribution.
The web interface has several bugs, some changes of config variables will change variables in other configuration pages. A notable example is the defaults page. In this page the default state of the relais can be set. When changing anything on that page, the device will also change the scenario to bypass.
Worse, when changing the mailserver page (the device is able to notify you via email if something bad happens) the dhcp setting is reset. This means on next powerup the device probably won’t try to get it’s ip via dhcp but use whatever happens to be the currently configured IP address. I didn’t try to reboot the device in this state because I noticed (and was looking for) this side-effect because I was already searching for a pattern in the failures.
Getting the config is easy, it’s under the url http://fos/config.txt where fos is the device. The following text file is retrieved:

bnfos_confmap_magic=0.1
1_sz=0
4_mode=0
1_rm=checked
5_p0=0
1_p0=
5_p1=0
1_p1=
3_dn=
3_ip=10.23.5.100
3_nm=255.255.255.0
3_gw=10.23.5.254
3_dns=10.23.5.254
3_dhcp=checked
3_port=80
3_pwd=
2_mhost=0.0.0.0
2_mfrom=
2_mto=
3_log=
3_loghost=0.0.0.0
6_wen=0
2_wen=
6_wstate=0
2_wintv=60
2_as=checked
2_men=
0_wretv=0

Apparently all configuration variables that influence other variables are in the same group: They have the same number in front.
The bugs of the web interface are not browser-specific. In fact the command-line tools also use the http-interface of the device to set and get options:

% bnfos/bnfos --get scenario -h 10.23.5.100
scenario = 0
zsh: exit 167   bnfos/bnfos --get scenario -h 10.23.5.100
% bnfos/bnfos --set modedef=0 -h 10.23.5.100
Setting modedef succeeded!
% bnfos/bnfos --get scenario -h 10.23.5.100
scenario = 1
zsh: exit 167   bnfos/bnfos --get scenario -h 10.23.5.100

Exit-code of the bnfos tool when querying a variable is always 167. It also doesn’t follow the UNIX mantra for command-line tools: Be silent on success, noisy on error. But we also see here that the bug appears with the command-line tool too: changing the default relais mode also changed the scenario.
When looking with wireshark we see that for setting the variable with the command-line tool it just retrieved the URL /?cmd=1&rm=0 with a HTTP Get-request.
When using the --show switch, output is on stderr so piping the result needs special shell commands ( |& is a zsh shortcut for piping both, stdout and stderr):

% bnfos/bnfos --show -h 10.23.5.100 |& grep dhcp
 dhcp      = 1
zsh: exit 167   bnfos/bnfos --show -h 10.23.5.100 2>&1 |

Setting the mail parameters smtpserv, smtpfrom and smtpto is impossible via the command-line interface. We always the the cryptic error message:

% bnfos/bnfos --set smtpto='10.23.5.5' -h 10.23.5.100
Setting smtpto failed: Could not parse!
zsh: exit 1     bnfos/bnfos --set smtpto='10.23.5.5' -h 10.23.5.100

Studying the code of the config-tool reveals that there are two configuration tables, one in src/beronet/confmap_fos.h named bnfos_confmap which includes all info about the low-level device parameters:

static const struct {
  char *key;
  char type;
  int cmd;
  char *parm;
  char *macro;
} bnfos_confmap[BNFOS_MAX_KEYS] = {
  { "sz"     , 'b', 1, "sz=%s"    , "szenario(0)"},
  { "mode"   , 'b', 4, "mode=%s"  , "mode(0)"},
  { "rm"     , 'b', 1, "rm=%s"    , "config(1,1)"},

  { "p0"     , 'b', 5, "p=0&s=%s" , "pwrport(0,0)"},
  { "p0"     , 'b', 1, "p0=%s"    , "config(2,1)"},
  { "p1"     , 'b', 5, "p=1&s=%s" , "pwrport(0,1)"},
  { "p1"     , 'b', 1, "p1=%s"    , "config(3,1)"},

  { "dn"     , 'h', 3, "dn=%s"    , "hostname(1)"},
  { "ip"     , 'a', 3, "ip=%s"    , "netconf(0)"},
  { "nm"     , 'a', 3, "nm=%s"    , "netconf(1)"},
  { "gw"     , 'a', 3, "gw=%s"    , "netconf(2)"},
  { "dns"    , 'a', 3, "dns=%s"   , "netconf(3)"},
  { "dhcp"   , 'b', 3, "dhcp=%s"  , "config(4,1)"},
  { "port"   , 'p', 3, "port=%s"  , "netconf(6)"},
  { "pwd"    , 'b', 3, "pwd=%s"   , "config(5,1)"},
  { "apwd"   , 'd', 3, "apwd=%s"  , NULL},

  { "mhost"  , 's', 2, "mhost=%s" , "netconf(5)"},
  { "mfrom"  , 's', 2, "mfrom=%s" , "netconf(7)"},
  { "mto"    , 's', 2, "mto=%s"   , "netconf(8)"},
  { "XXXXX"  , 'n', 7, ""         , NULL},

  { "log"    , 'b', 3, "syslog=%s", "config(10,1)"},
  { "loghost", 'a', 3, "slgip=%s" , "netconf(9)"},
  { "logport", 'p', 3, "slgpt=%s" , "netconf(10)"},

  { "wen"    , 'b', 6, "wen=%s"   , "wdog(0)"},
  { "wen"    , 'b', 2, "wen=%s"   , "config(6,1)"},
  { "wstate" ,   0, 6, "wstate=%s", "wdog(0)"},
  { "wintv"  , 'p', 2, "wintv=%s" , "config(8,?)"},
  { "as"     , 'b', 2, "as=%s"    , "config(9,1)"},
  { "men"    , 'b', 2, "men=%s"   , "config(7,1)"},
  { "wretv"  ,   0, 0, NULL       , "wdog(2)"},
};

and one in bnfos/main.c that maps the high-level command-line paramters to the low-level http requests:

/* keyword description for --set / --get */
static struct {
  char *keyword;
  char *descr;
} keys[BNFOS_MAX_KEYS] = {
  {"scenario", "scenario (0=fallback; 1=bypass)"},

  {"mode", "relais mode (0=A--D; 1=A--B or A--B,C--D)"},
  {"modedef", "default relais mode (0=A--D; 1=A--B or A--B,C--D)"},

  {"power1", "state of powerport 1 (0=off; 1=on)"},
  {"power1def", "default state of powerport 1 (0=off; 1=on)"},
  {"power2", "state of powerport 2 (0=off; 1=on)"},
  {"power2def", "default state of powerport 2 (0=off; 1=on)"},

  {"hostname", "device hostname"},

  {"address", "ip address"},
  {"netmask", "netmask address"},
  {"gateway", "gateway address"},
  {"dns", "dns server address"},
  {"dhcp", "query dhcp server (0=off; 1=on)"},
  {"port", "http listen port"},
  {"pwd", "http password protection (0=off; 1=on)"},
  {"apwd", "admin password"},

  {"smtpserv", "smtp server"},
  {"smtpfrom", "smtp sender address"},
  {"smtpto", "smtp destination address"},
  {"smtptest", "trigger testmail"},

  {"syslog", "syslog logging (0=off; 1=on)"},
  {"slgip", "syslog server ip"},
  {"slgpt", "syslog server port"},
  {"wdog", "watchdog enable (0=off; 1=on)"},
  {"wdogdef", "default watchdog enable (0=off; 1=on)"},
  {"wdogstate", "watchdog state (0=off; 1=on; 2=failure)"},
  {"wdogitime", "watchdog intervall time"},
  {"wdogaudio", "watchdog audio alarm (0=off; 1=on)"},
  {"wdogmail", "watchdog alarm mails (0=off; 1=on)"},
  {"wdogrtime", "watchdog remaining time to failure"},
};

I haven’t found a mechanism that keeps these two tables in different source files in sync (they currently seem to be), looks like both tables need to have the matching options in the same place in both tables. The code for matching options to low-level commands just uses the same index to navigate in both tables.
The bnfos_confmap table has a s for the type of the smtp parameters. This type isn’t handled in the config-tool and leads to the cryptic error message above. Patching the table to specify the type h (there is a comment XXX check hostname for validy for that type this checking apparently isn’t done yet, so we can use the code there to parse normal strings) would work. After applying a patch to src/beronet/confmap_fos.h, the sources aren’t recompiled, seems that the Makefile is broken, too. So after a make clean ; make I’m finally able to set the smtp parameters via the command-line interface:

% bnfos/bnfos --set smtpserv='10.23.5.5' -h 10.23.5.100
Setting smtpserv succeeded!

Looking over this again, I prefer to do the following patch that adds support for the ’s’ type:

--- bntools/src/bnfos.c 2007-08-28 09:27:46.000000000 +0200
+++ bntools.hacked/src/bnfos.c  2009-04-09 12:10:46.000000000 +0200
@@ -379,6 +379,14 @@
     set->val = strdup(val);
     return BNFOS_RET_OK;

+  case 's':
+    /* Allow empty strings */
+    if (!val) {
+        val = "";
+    }
+    set->val = strdup(val);
+    return BNFOS_RET_OK;
+
   case 'p':
     {
       int v;

This is a cleaner way to make configuring the smtp parameters work. Turns out that setting the mail gw does not influence the dhcp setting. But in the web-interface, the mail gateway and the syslog server are combined in one page. so trying that:

% bnfos/bnfos --show -h 10.23.5.100 |& grep dhcp
 dhcp      = 1
zsh: exit 167   bnfos/bnfos --show -h 10.23.5.100 2>&1 |
zsh: done       grep dhcp
% bnfos/bnfos --set slgip='10.23.5.5' -h 10.23.5.100
Setting slgip succeeded!
% bnfos/bnfos --show -h 10.23.5.100 |& grep dhcp
 dhcp      = 0
zsh: exit 167   bnfos/bnfos --show -h 10.23.5.100 2>&1 |
zsh: done       grep dhcp

we see that changing the syslog server also changes the dhcp setting like in the web-interface. When looking more closely, we see that the dhcp and the syslog IP are in the same cmd group. Thats the number in column 3 of the bnfos_confmap and the number in from of each line in config.txt retrieved via the web interface.
So the workaround for the bug in the firmware is to write a config program that retrieves all variables in the same cmd group and, when setting one of the variables in that group, also send all the other current settings in the same get-request.
Fortunately the bnfos_confmap table has the command pattern for generating the get-request for each of the variables in column 4 (parm). So it shouldn’t be too hard to write a new config utility (and of course I won’t do that i C either) that works around the firmware bugs.
I already said that I would have preferred an open firmware to fix the bugs at the source, did I?