diff --git a/Tech/Sessions/cac-manjaro-thinkpad.md b/Tech/Sessions/cac-manjaro-thinkpad.md new file mode 100644 index 0000000..8cee7c9 --- /dev/null +++ b/Tech/Sessions/cac-manjaro-thinkpad.md @@ -0,0 +1,84 @@ +--- +project: cac-manjaro-thinkpad +type: tech-setup +status: completed +path: Tech/Sessions +tags: + - cac + - manjaro + - thinkpad + - pcscd + - opensc + - firefox +created: 2026-04-15 +updated: 2026-04-15 +--- + +# CAC Setup — Manjaro ThinkPad + +## Overview + +CAC authentication configured and working on Manjaro ThinkPad using +OpenSC + pcscd. Tested against Office 365 / DoD sites via Firefox. + +## Stack + +- **Middleware:** pcscd (pcsc-lite) +- **PKCS#11 module:** OpenSC — `/usr/lib/opensc-pkcs11.so` +- **Browser:** Firefox +- **Test tool:** pcsc_scan (pcsc-tools) + +## Working Session Flow + +1. Ensure pcscd is running: + ```bash + sudo systemctl start pcscd + ``` + +2. Verify card is detected (keep running in terminal): + ```bash + pcsc_scan + ``` + Confirm reader and card state are both visible before proceeding. + +3. Open Firefox and navigate to CAC-protected site — certificate +prompt should appear. + +## Firefox PKCS#11 Module + +One-time setup (persists across sessions, but may reset after Firefox updates): + +1. Firefox → Preferences → Privacy & Security +2. Scroll to **Security** section → click **Security Devices** +3. Click **Load** +4. Module name: `DoD CAC` +5. Module filename: `/usr/lib/opensc-pkcs11.so` + +> **Note:** Firefox updates have been observed to clear this setting. If CAC auth stops working after a Firefox update, re-load the module using the steps above before troubleshooting anything else. + +## Enable pcscd on Boot + +Run once so the daemon starts automatically — eliminates step 1 above +on future sessions: + +```bash +sudo systemctl enable pcscd +``` + +## Troubleshooting + +| Symptom | Fix | +|---|---| +| `pcsc_scan` shows no reader | Check USB connection, try `sudo +systemctl restart pcscd` | +| Reader visible but card not detected | Remove and reinsert CAC | +| Firefox not prompting for cert | Re-load OpenSC module in Security +Devices (see above) | +| pcscd daemon crashed | `sudo systemctl restart pcscd`, then re-run +`pcsc_scan` | + +## References + +- https://militarycac.com/linux.htm +- https://wiki.archlinux.org/title/Common_Access_Card +- https://github.com/jdjaxon/linux_cac \ No newline at end of file