July 2010 - SmartcardServices-Users

CAC and Mac Os X Server
by John Daly 28 Jul '10

28 Jul '10

I¹ve asked this question in many other forums, and so far have never got an answer. Maybe since this is dedicated to smartcard services, someone here will know. Has anyone ever managed to get Open Directory Network accounts to work with CAC login? If so, how? My system is fully kerberized with single sign-on for most things, so if I can just get the CAC to work for login then all the kerberized services should allow the CAC to work for single sign-on for all my mac services. I have Mac Os X Server 10.5.8 (can¹t go to 10.6 until I can justify and fund new hardware) Thank you, John -- John Daly Apple Certified Technical Coordinator Sysadmin 474300D

3 2

Custom Smart Card Source
by Bob Colbert 27 Jul '10

27 Jul '10

Does anyone know of a company that can provide custom printed Smart Cards for company PhotoIDs. In addition, I would hope that the provided Smart Card would be compatible with the current state of SmartCard support and with a working tokend for Snow Leopard. I understand that part of it is choosing an already supported reader. Apparently, I have discovered with my current ActivIdentity USB token that the reader portion of the token is supported, however the card profile needs to be updated to properly read the certificates from the USB token. The Smart Card should have the capability for supporting the External Certification Authority type certificates - http://iase.disa.mil/pki/eca/ . Another capability would be that the Smart Card is compatible with ActivClient for Windows for key generation and/or certificate import. Unless there is another way under Snow Leopard to generate key requests on the card or otherwise import software certificates onto them? Thanks, Bob Colbert

3 7

Re: [SmartcardServices-Users] [Fed-Talk] CAC Reader and AKO on Older MacBookPro
by Shawn A. Geddis 26 Jul '10

26 Jul '10

Paul, Ahh, I understand the confusion. When you were prompted for a "Password" and you entered the "PIN" it was not saved in your file-based keychain, but rather the system "unlocked" your Smart Card ( a Smart Card IS a Keychain). Some dialogs still refer to "password" while displaying the name of the Keychain (your Smart Card Name), but the "PIN" you entered is never stored in a file-based Keychain. The PIN is used as part of the Challenge-Response with the card which is frequently referred to as "unlocking" your card. While your card remains in the reader after entering the PIN, the PIN is cached by the security server to prevent your needing to re-enter it for every single transaction involving the private key(s). If you pull the card, log out or shut the system down, the cached PIN is thrown away and you would then need to enter the PIN again next time you need to access the private key(s). This is also true if you switch between Mac OS X and a virtualized environment using the Smart Card. - Shawn _____________________________________________________ Shawn Geddis - Security Consulting Engineer - Apple Enterprise On Jul 26, 2010, at 7:35 AM, Villano, Paul Mr CIV USA TRADOC wrote: > The "password" that was saved was the PIN for the CAC. It did go through the CAC and worked. > > ----- Original Message ----- > From: "Shawn A. Geddis" <geddis(a)apple.com> > Date: Wednesday, July 21, 2010 16:37 > Subject: Re: [Fed-Talk] CAC Reader and AKO on Older MacBookPro > To: "Villano, Paul Mr CIV USA TRADOC" <paul.villano(a)us.army.mil> > Cc: fed-talk(a)lists.apple.com > > >> On Jul 20, 2010, at 8:48 AM, Villano, Paul Mr CIV USA TRADOC wrote: >>> So I finally got around to testing from home the CAC reader I >> got from the suggestions from folks on this list. I was prepared >> for a longish session of downloading certificates and what not. >> Instead I said, what the hey, why not just try it? So I just >> stuck the card in, clicked the CAC/Low bandwidth button on AKO, >> added the p/w to my keychain, and...well...It just worked! :o) >>> >>> Anything I'm missing? Am I supposed to download something else? >> Even though I'm typing this it's hard to believe it worked >> within about 10 seconds. >> >> >> Paul, >> >> If you added ANY password to you keychain it would mean that a >> Smart Card was not in use, since there would be nothing to store >> inside of a keychain --> A Smart Card IS a Keychain. >> >> You shouldn't experience any issues in using the CAC, but wanted >> to point out that your ref to saving a p/w in your keychains >> indicates you were not using your CAC. >> >> Keep in mind that all Smart Card related User questions, comments, >> issues should all go to the SmartCardServices lists.... >> >> http://lists.macosforge.org/mailman/listinfo.cgi/smartcardservices- >> users >> - Shawn

1 0

OpenDirectory and CAC
by Mike Hjorleifsson 22 Jul '10

22 Jul '10

Shawn, to be clear this should work with PIV as well correct ? John, > > As I just noted to Bram, you need to just do the following for SSO with CAC > at Login (PKINIT). > > Mac OS X 10.6.3 has PKINIT support built in, but you need to make some very > minor config changes to fully enable for Login. I will attempt to get draft > instructions up very soon. > > Add PKINIT information to /etc/authorization file > > Please make sure to make a backup of the /etc/authorization file before you > make any changes as a misconfigured version of this file may prevent the > system from booting. A backup of the authorization file could be done with > the following command: > > cp /etc/authorization /etc/authorization_original_`date +%M-%H-%m-%d-%y` > > Edit the /etc/authorization file to add > <string>PKINITMechanism:auth,privileged</string> below > <string>MCXMechanism:login</string> as in the example below. This could be > done with a defaults command or plistbuddy. > > <key>system.login.console</key> > <dict> > <key>class</key> > <string>evaluate-mechanisms</string> > <key>comment</key> > <string>Login mechanism based rule. Not for general use, > yet.</string> > <key>mechanisms</key> > <array> > > <string>builtin:smartcard-sniffer,privileged</string> > <string>loginwindow:login</string> > <string>builtin:reset-password,privileged</string> > <string>builtin:auto-login,privileged</string> > <string>builtin:authenticate,privileged</string> > <string>loginwindow:success</string> > <string>HomeDirMechanism:login,privileged</string> > <string>HomeDirMechanism:status</string> > <string>MCXMechanism:login</string> > <string>PKINITMechanism:auth,privileged</string> > <string>loginwindow:done</string> > </array> > </dict> > > > > Test to verify PKINIT is working > > First, insert your smart card into the reader. Run the following command to > verify that PKINIT is working: > > /System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kinit -C > KEYCHAIN: -D KEYCHAIN: --windows --pk-enterprise > > If the command works, you should be prompted for a PIN. You can verify that > you have a kerberos ticket by opening Keychain Access and going to Ticket > Viewer or by going to Terminal and typing klist. > > > -Shawn > >

3 2

Re: [SmartcardServices-Users] [Tokend-Dev] PIV Auth with CRL Checks
by Shawn A. Geddis 21 Jul '10

21 Jul '10

On Jul 21, 2010, at 2:54 PM, Bram Cymet wrote: > Hi, > > I hope this is the right list to send this to and if it is not please let me know where the right place would be. > > I have successfully got PIV cards working for login and screensaver access under Snow Leopard. The problem I am having is that it seems to ignore the fact that Keychain Access sees the certs on the cards as being revoked. > > Is it possible with the current Tokend/Smartcardservices to make it so that if a cert has been revoked that a person using that card is no longer able to log into the system? Or will I have to make some modifications to get this functionality working? > > Thanks, > > -- > Bram Cymet > Software Developer > Canadian Bank Note Co. Ltd. > Cell: 613-608-9752 Bram, This list is specifically for Tokend Development and your question is a User Question in the use of Smart Cards on a Mac OS X System. I will cc the User's list in my response, but keep in mind that this particular list is for those "developing" a Tokend. You will need to explain which method you are using for Client Authentication: • PubKeyHash - Does not require that the Certificate itself has not been revoked • Attribute Matching - Leveraging attribute(s) from the cert on the card to determine which DS Account to Authenticate against • PKINIT (SSO to DS) - Validates the cert / cert chain locally as well as authenticates to Kerberos KDC with that Certificate. Which method are you using ? -Shawn __________________________________________________ Shawn Geddis geddis(a)mac.com Security Consulting Engineer geddis(a)apple.com MacOSForge Project Lead: Smart Card Services Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo __________________________________________________

2 2

CAC-NG 10.5.8 repeatedly rejects certs
by John Daly 21 Jul '10

21 Jul '10

Greetings, I have to add a ³me too² to those folks who have installed the CAC-NG tokend and find that while the keychain shows their certs, and they can set up identity preferences to use those certs, when trying to use Safari to get to a site, you get an error message requesting that you select a certificate. No matter what certificate is selected, you just get the selection again. Reading the text of the selection box, you find that it says the site has rejected the certificate and is therefore requesting another. So, here are the additional things that I have done which I have not seen in any of the previous posts about this issue. I have only 3 people who have the CAC-NG card at this time. One of those has a new machine which is running 10.6. I installed the CAC-NG tokend and her system functions (mostly) beautifully. The 10.5.8 system exhibits the behavior above. I took the CAC card from the person on the 10.5.8 system to the 10.6 system and used it there successfully, indicating that the problem is not that there is something wrong with her certificates. Both cards work in the 10.6 system. Neither card works in the 10.5.8 system. Finally, I set the debugger as Shawn outlined in a previous post. These are the results. The timestamp indicates that these results are logged at the moment in which Safari is attempting to log into a CAC-enabled website (https://webmail.west.nmci.navy.mil in this case). For privacy reasons, I¹ve replaced the actual certificate name with <CAC_Certificate>. This string of errors shows up in the system.log every time I try to log into a CAC-enabled site. Jul 14 15:43:36 mac /Applications/Safari.app/Contents/MacOS/Safari[75221]: preferred identity: "<CAC_Certificate>" found for "https://webmail.west.nmci.navy.mil/exchange" Jul 14 15:43:36 mac /Applications/Safari.app/Contents/MacOS/Safari[75221]: lookup complete; will use: "<CAC_Certificate>" for "https://webmail.west.nmci.navy.mil/exchange" Jul 14 15:43:37 mac securityd[22]: securityd(22,0xb0081000) malloc: *** error for object 0x121f000: pointer being freed was not allocated\n*** set a breakpoint in malloc_error_break to debug Jul 14 15:43:37 mac com.apple.SecurityServer[22]: securityd(22,0xb0081000) malloc: *** error for object 0x121f000: pointer being freed was not allocated Jul 14 15:43:37 mac com.apple.SecurityServer[22]: *** set a breakpoint in malloc_error_break to debug -- John Daly Apple Certified Technical Coordinator Sysadmin 474300D

2 1

(no subject)
by rmmasica＠fastmail.fm 07 Jul '10

07 Jul '10

I am having issues accessing DoD CAC-enabled sites from my home computer (MacBook 2.2GHz Intel Core 2 Duo with OSX 10.5.8) using Safari Version 5.0 (5533.16) since I received an updated DoD Gemalto TOPDLGX4 144 Smart Card. I was able to access DoD sites (specifically https://webmail.east.nmci.navy.mil/) with my old CAC card without issue. When I open Keychain Access with the CAC in the card reader, I am able to see the CACNG in the list and see four certificates (2 DOD CA-24 and 2 DOD EMAIL CA-24 certificates) and am able to set an identity preference assigning the certificate (DOD EMAIL CA-24) but when I try to access the NMCI webmail site listed above, I get into a do-loop in Safari where it keeps asking me which certificate I want to use. I have reviewed the Smart Card Services users list and see several other tickets describing this same problem. Please advise on any tips to correct this discrepancy. Thank you. Regards, Mike Masica

1 0

NG CAC Problems
by Mike Masica 07 Jul '10

07 Jul '10

I am having issues accessing DoD CAC-enabled sites from my home computer (MacBook 2.2GHz Intel Core 2 Duo with OSX 10.5.8) using Safari Version 5.0 (5533.16) since I received an updated DoD Gemalto TOPDLGX4 144 Smart Card. I was able to access DoD sites (specifically https://webmail.east.nmci.navy.mil/) with my old CAC card without issue. When I open Keychain Access with the CAC in the card reader, I am able to see the CACNG in the list and see four certificates (2 DOD CA-24 and 2 DOD EMAIL CA-24 certificates) and am able to set an identity preference assigning the certificate (DOD EMAIL CA-24) but when I try to access the NMCI webmail site listed above, I get into a do-loop in Safari where it keeps asking me which certificate I want to use. I have reviewed the Smart Card Services users list and see several other tickets describing this same problem. Please advise on any tips to correct this discrepancy. Thank you. Regards, Mike Masica

1 0

CAC-NG Beta Leo and PPC (OS 10.5.8)
by Dr. M. J. Hewlett 03 Jul '10

03 Jul '10

Hi, everyone: I'm new to this list, so let me apologize if this has already been discussed. I'm trying to help my son with a PowerBook G4 (OS 10.5.8) get set up to read his CAC. The card is of the new type (Gemalto TOP DL GX4 144K, or CAC-NG). We have upgraded the firmware on the reader and installed CAC-NG Beta Leo. However, when we insert the card, KeyChain Access does not allow access. The card is listed, but with not certificates shown. This same card will work on my MacBook Pro (Intel, OS 10.6.4), allowing access to the certificates. Has anyone else had this same problem? If so, is there something else we can do? Thank you for your responses, Marty Hewlett -------------------- Martinez J. Hewlett, Ph.D., O.P.L. Dept. of Molec. & Cell. Biology Univ. of Arizona, Tucson, Arizona and Dominican School of Philosophy and Theology Graduate Theological Union Berkeley, California hewlett(a)u.arizona.edu "Contemplare et contemplatus aliis tradere"

1 0