# Need a way to disable smartcard on server

**URL:** <https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556>\
**Category:** Community Support\
**Tags:** tlserver\
**Created:** [16 February 2023 16:10 UTC](https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556 "2023-02-16T16:10:10Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![kbass](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/kbass/32/211_2.png) [@kbass](https://community.thinlinc.com/u/kbass)\
**Post date:** [16 February 2023 16:10 UTC](https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556/1 "2023-02-16T16:10:10Z")

</div>

I use thinlinc to connect to a headless server in the same physical room. I recently got a smartcard and was trying to use it LOCALLY. For a moment I had forgotten I was using Thinlinc. I spent hours and hours trying to figure out why I could read the smartcard ceritificates as root user, but not as my normal user. I was looking at permissions and polkit, etc. I finally realized there was some PCSCTUN\_SERVER environment variable set that was interfering. I couldn’t find anything in the p11 or opensc or pcsc documentation about this environment variable. It turns out it must be ThinLinc related.

Is there an option to disable the smart card direction on the server? The admin guide says:

‘Enabling Smart Card Redirection  
Smart card redirection is always activated on the server so there is no administration required to enable it.’

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [17 February 2023 07:57 UTC](https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556/2 "2023-02-17T07:57:01Z")

</div>

Hello @kbass

I’m not sure if I understand what problem you’re facing, and why disabling smart card redirection would solve it?

To disable it, you can uncheck ‘Smart Card Readers’ in ThinLinc Client under ‘Local Devices’.

Regards,  
Martin

---

<div class="post-metadata">

**Author:** ![kbass](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/kbass/32/211_2.png) [@kbass](https://community.thinlinc.com/u/kbass)\
**Post date:** [17 February 2023 13:54 UTC](https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556/3 "2023-02-17T13:54:38Z")

</div>

Hi @martin - To summarize my original post. I am trying to use a smart card that is connected to the SERVER while I am logged in via the thinlinc client. The thinlinc server installation interferes with using that when logged in by thinlinc client. It has nothing to do with the client side setting.

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [17 February 2023 15:10 UTC](https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556/4 "2023-02-17T15:10:29Z")

</div>

That’s not a use-case I’ve heard of before, so not sure what’s going on really. But it sounds as a permission problem. Since you’re logged in remotely, your user will probably not have sufficient privileges to access local attached hardware. Polkit will most likely refuse some access. Have you tried enabled debug logging in Polkit and see what it says?

To disable smart card redirection on server-side, it should be sufficient to remove the symlink

```auto
/opt/thinlinc/etc/xstartup.d/50-tl-wait-smartcard

```

and then restart your session.

Regards,  
Martin

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [17 February 2023 16:07 UTC](https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556/5 "2023-02-17T16:07:09Z")

</div>

I just gave it a go, and I believe what you’ll need to do are:

```auto
echo "unset LD_LIBRARY_PATH" >> ~/.bash_profile

```

Then create the polkit allow rules:

```auto
# cat >> /etc/polkit-1/rules.d/00-allow-smartcard.rules<<EOF
polkit.addRule(function(action, subject) {
    if (action.id == "org.debian.pcsc-lite.access_card" &&
        action.lookup("reader") == 'YOU_READER_NAME' &&
        subject.user == "YOUR_USER") {
            return polkit.Result.YES;
    }
});

polkit.addRule(function(action, subject) {
    if (action.id == "org.debian.pcsc-lite.access_pcsc" &&
        subject.user == "YOUR_USER") {
            return polkit.Result.YES;
    }
});
EOF

```

Replace `YOUR_USER` and `YOU_READER_NAME`. You can find your card reader name with

```auto
opensc-tool -l

```

Then restart the services  
`systemctl restart pcscd.service pcscd.socket polkit.service `

Restart your ThinLinc session after this and try accessing your card reader.

This was tested on an RHEL8 system.

Kind regards,  
Martin

---

<div class="post-metadata">

**Author:** ![kbass](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/kbass/32/211_2.png) [@kbass](https://community.thinlinc.com/u/kbass)\
**Post date:** [17 February 2023 16:13 UTC](https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556/6 "2023-02-17T16:13:54Z")

</div>

I had already made those polkit changes (and also added polkit logging) when I realized something was sitting between the smartcard and my user account. The polkit rules were never even being hit. That is when I realized there was PCSCTUN\_SERVER environment variable that was unexpected. I believe thinlinc server is adding that.

I am not sure about using unset LD\_LIBRARY\_PATH - I am sure I have other libraries that need to be loaded for other purposes. Is there a specific library path I need to be removing related to thinlinc and the smartcard? Maybe just figuring out how the disable the setting of the PCSCTUN\_SERVER would be enough.

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [17 February 2023 17:11 UTC](https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556/7 "2023-02-17T17:11:13Z")

</div>

Sorry, I meant to add to check for any local LD\_LiBRARY\_PATH first. On my test system there was only path to /opt/thinlinc… added to it. It should be sufficient to remove /opt/thinlinc from LD\_LIBRARAY\_PATH

---

<div class="post-metadata">

**Author:** ![kbass](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/kbass/32/211_2.png) [@kbass](https://community.thinlinc.com/u/kbass)\
**Post date:** [18 February 2023 16:19 UTC](https://community.thinlinc.com/t/need-a-way-to-disable-smartcard-on-server/556/8 "2023-02-18T16:19:00Z")

</div>

Thanks for mentioning the LD\_LIBRARY\_PATH. Rather than modify that and potentially disable other features (pulse, etc), I ended up doing the following commands:

```auto
cd /opt/thinlinc
rm lib64/libpcsclite.so lib64/libpcsclite.so.1 lib64/libpcsctun.so lib/libpcsctun.so lib/libpcsclite.so lib/libpcsclite.so.1 

```

Once I made that change, the polkit entries I had previously made were triggered and I could access the Smartcard.