SiRFIDaL - Simple RFID authentication for Linux

I finally took the time to make a pre-built .deb package for SiRFIDaL. I rewrote a few things so that it works (almost) right out of the box on Ubuntu and Debian as well as Linux Mint.

The PPA repository is here: https://github.com/Giraut/ppa. All you have to do to install SiRFIDaL is:

  • Add the repository to your APT sources:
curl -SsL https://raw.githubusercontent.com/Giraut/ppa/master/KEY.gpg | sudo apt-key add -
sudo curl -SsL -o /etc/apt/sources.list.d/giraut.list https://raw.githubusercontent.com/Giraut/ppa/master/giraut.list
sudo apt update
  • Install the package
apt install sirfidal
2 Likes

I went ahead and wrote a PKGBUILD for the Arch AUR for both SiRFIDaL and pyufr (Arch requires that all dependencies are installed, even for optional features, so I had to make a separate pyufr AUR package to fulfill that requirement).

The AUR package is sirfidal-git.

Using any AUR helper, it should automatically pull and install the second AUR package, python-pyufr-git.

Itā€™ll automatically install all files to their correct places, with the locations tweaked properly for Arch-based distros. Configuration must still be done as mentioned in the git repo, and the systemd services are disabled by default to ensure that proper configuration is done first.

Hopefully this helps Arch users get a quick start.

2 Likes

Nice work! now if I could just get my lazy ass around to trying arch againā€¦

Thatā€™s great! Thanks!

I really need to give Arch a spin. Iā€™ve been meaning to for some time but I think your contribution gives me an incentive now :slight_smile:

Iā€™ve used a lot of Linux distros in the past 8 years, but I always find myself coming back to Arch. The lack of bloat, combined with setting up things the way I want, makes it a joy to come back to. The install process complexity is a bit overblown online, itā€™s just reading the Installation Guide on the wiki. Takes me about 10 minutes to do an install, and it has all of the software I use ready for when I do my first boot. The AUR alone is a massive draw for me, I can always install the software I need (even if the software license doesnā€™t match the ethics of the distro maintainersā€¦)

Itā€™s also nice to always have up-to-date packages. When I ran Debian, even on testing, Iā€™d run into bugs constantly that had already been fixed weeks prior.

If you try Arch at some point and find any packaging issues, feel free to let me know. Itā€™s super easy for me to push changes to the PKGBUILD. I donā€™t have a lot of the reader hardware (serial readers for instance), so itā€™s hard for me to 100% confirm that everything works.

If you make any changes to directory structure, try and make a post in this thread (or a README change), so I can make the necessary changes. The package is set up to pull the latest version of the git repo, so any changes in the files themselves will update in the AUR PKGBUILD automatically.

I started out with Slackware back in 1996 or something (so the complexity doesnā€™t bother me :slight_smile:), then worked professionally with Caldera OpenLinux (which was RPM-based) and finally settled on .deb-based distros because Iā€™ve grown too lazy to fudge around with source packages and such anymore, and pre-chewed Linux distros pretty much Just Workā„¢ nowadays. At least they work plenty well enough for what I want to do.

As for releasing stuff, I donā€™t want to touch RPM anymore (see above) but I do release .debs because they also Just Workā„¢ for everybody else. Most people donā€™t like complexity.

I probably wonā€™t. You might have noticed that I keep everything in a flat directory, most of the Python code is self-contained (apart from the clients which use that one single class file) despite making the code really heavy, and everything is kept as ā€œsmallest common denominatorā€ as possible - Including the full-ASCII README :slight_smile: I do that on purpose to keep installation complexity and potential runtime problems to a minimum,

Darthdomo: just so you know, I just released SiRFIDaL 1.2.0 which adds a new dependency on a new package, pam_python (http://pam-python.sourceforge.net/). On Arch, itā€™s this package I believe: AUR (en) - pam-python.

Sorry to change everything so soon since you made the Arch PKGBUILD: I was planning on switching the PAM module to pam_python eventually, but decided to do it after Mekhos mentioned he was unlocking his password manager using the autotyper. pam_python lets the SiRFIDaL PAM module bubble up the authentication token to Gnome Keyring Pam, so that itā€™ll automatically unlock the keyring from the login credentials, which is a lot cleaner than the autotyper kludge. But of course it means rewriting the PAM module and changing the dependency, which is why I hadnā€™t done it. But I thought, what the hellā€¦ So I did it. Sorry :slight_smile:

2 Likes

All good :+1:

PKGBUILD has been updated, and the new version pushed to the AUR.

1 Like

That was quick :slight_smile:
Thanks!

And another version, and another dependency: Arch Linux - python-pyperclip 1.8.2-1 (any)

This one adds the ability to copy UIDs into the system clipboard from the autotyper - something thatā€™s rather needed if the user is to set their implant UID to unlock their password manager.

Sorry againā€¦ Itā€™s the weekend and Iā€™m going back to the hospital tomorrow. So Iā€™m cramming in as many new improvements as I can before Iā€™m too out of commission.

PKGBUILD updated, and new version pushed to AUR.

I was in bed, but thanks to the magic of Android SSH apps and my desktop always being on, I was able to quickly add it haha.

1 Like

Hehe thanks :slight_smile:

Donā€™t worry, I should be done for some time now. Itā€™s stuff I wanted to push in and it so happens that I had some quality time at home this weekend to do stuff I like.

Anyway, mekhos, if you want, you can install the latest version, then do this as root to reconfigure everything proper-like:

pam-auth-update
systemctl daemon-reload
systemctl restart sirfidal_server

log out, log back in, then hold left-CTRL and left-ALT (or whatever you defined as hotkeys for the autotyper), scan your implant, copy the UID into the clipboard, then use the content of the clipboard as the new password for your keyring in KeePass.

That way, each time you log back in, the new SiRFIDaL PAM module will transfer your implantā€™s UID to KeePass and that should unlock your keyring automatically upon login. It works fine with Gnome Keyring, and the KeePass literature claims itā€™s compatible with Secret Service, so it should work the same way. That should take care of your issue by eliminating the need to autotype anything into KeePass altogether.

I modified a few things to make SiRFIDaL (mostly) compatible with RPM-based distributions out of the box - Fedora and such - and I created a RPM package for it.

The RPM repository is here: https://github.com/Giraut/rpm. To install SiRFIDaL, all you gotta do is this:

  • Add the repository:
dnf config-manager --add-repo https://raw.githubusercontent.com/Giraut/rpm/master/giraut.repo
  • Install the package
dnf install sirfidal
1 Like

Hereā€™s a video showing how to install SiRFIDaL in Linux Mint (same as Ubuntu fundamentally):

2 1/2 minutes and youā€™re good to go :slight_smile:

1 Like

If any of you tens of thousands of SiRFIDaL users - no doubt :slight_smile: - use an old cellphone as a USB reader, can you try using this app?

https://github.com/Giraut/SiRFIDaL/raw/master/SiRFIDaL_NFC_reader.apk

Itā€™s the Tasker script, but precompiled as a standalone app, so you donā€™t actually need Tasker or import the script into it manually. Just upload the APK file onto the cellphone somewhere, install it locally and run it (or, if youā€™re a geek, do adb install -r SiRFIDaL_NFC_reader.apk from your Linux box and run the app on the cellphone), and it should work the same way.

I tried it on the few test cellphones I have lying around and it seems to work okay, but it doesnā€™t behave quite the same way from one to the other. I you have a use for it, Iā€™d be curious to know if it works correctly for you.

Tested on a phone running AOSP (no GSF), Android 11.
Developer mode and USB debugging enabled. A notification with ā€œno active profilesā€ is displayed. When I scan, the SiRFIDaL app is an option for ā€œchoose an actionā€ but selecting it does nothing.

1 Like

Thanks for trying it!

It sounds like it works like itā€™s supposed to. The only thing it does when it runs is expose card UIDs into the logfile for SiRFIDaL to read if itā€™s connected.

If you enable the ADB listener in sirfidal_server_parameters.py, restart the server and connect your cellphone through USB, it should be visible in sirfidal_getuid.py when you scan your implant.

Nothing (Proxmark 3 working fine) I have enabled Android reader in sirfdal_server_parameters.py
Do I need latest version? Iā€™m still on the one where the parameters files were simplifiedā€¦~25th November

Maybe stop the server and type adb shell on the console. Iā€™ve seen cases where the cellphone wonā€™t ask permission for debugging if adb isnā€™t run manually at least once.

The old version should work also. Functionally nothing has changed in the Android listener.

If it doesnā€™t work, donā€™t worry about it. I donā€™t want to waste your time.

Yep, it got shell but still showing nothing in _getuids.py. Maybe there is a way to confim if its entering uid into the phone logs?