September 2010 - SmartcardServices-Users

Smartcard support from third party dylib
by Lorenzo Dalrio 12 Oct '10

12 Oct '10

Hi all, I'm a system admin from Italy, I'm trying to make a smartcard working for login. The vendor provided us with a precompiled dylib. I'm able to use the smartcard with firefox by adding a new security device and passing the dylib as the provider. Same thing with openvpn. I have searched how to add a custom provider to smartcardservices to make it use the dylib but I haven't found anything useful. Could you please give me some tips about this problem? The secure.log shows those messages when the card is inserted: Sep 28 12:59:12 gollum com.apple.SecurityServer[22]: Token reader SCM SCR 355 00 00 inserted into system Sep 28 12:59:14 gollum com.apple.SecurityServer[22]: token in reader SCM SCR 355 00 00 cannot be used (error 229) Thank you in advance, Lorenzo Dalrio

3 9

Help With Smart Cards
by iTanakh Support 09 Sep '10

09 Sep '10

Hello, Im new to this whole mailing list thing. I just purchased a contact-less smart card reader and I want to login to my mac os x server network using my card. Is this possible? Thanks, Nathan

2 1

[Announce] Smart Card Reader Available via Apple Online Store & Sales Teams
by Shawn A. Geddis 09 Sep '10

09 Sep '10

I am very pleased to announce the immediate availability of the SCM SCR3500 Smart Card Reader on both the Apple Online Store (US) as well as from your Apple Sales Team. Apple Store Link - (US Store ONLY at this time) -------------------------------------------------------- SCM SCR3500 Smart Card Reader http://store.apple.com/us/product/H2312LL/A Approvals -------------- GSA Approved http://www.scmmicro.com/fileadmin/products/datasheets/SmartFold_SCR3500_GSA… Mac OS X Support ------------------------- Fully supported by built-in CCID driver that shipped with Mac OS X. Recommended to use 10.5.6 and higher, 10.6.x Apple Smart Card Services Project @ MacOSForge - All development, questions, documentation (coming), etc. - http://SmartCardServices.MacOSForge.Org/ SCM Microsystem Product Datasheet -------------------------------------------------- http://www.scmmicro.com/fileadmin/products/datasheets/Dat_SCR3500_e.pdf ------------------------------------------------ SCM SCR3500 Smart Card Reader Overview The "SmartFold" SCR3500 mini USB reader is a fully ISO7816 compliant contact smart card reader. Due to its compact design the SCR3500 is ideally suited as a mobile reader device that can easily fit in the user's pocket or be attached to a key ring. Features • USB 2.0 full-speed • USB Bus Powered device • High-speed performance • CCID compliant • Supports ISO 7816 Class A, B, and C smart cards • Portable, small ergonomic design You can also contact your Apple Sales Team ! - Shawn _____________________________________________________ Shawn Geddis - Security Consulting Engineer - Apple Enterprise

1 0

tokenadmin, FileVault etc
by Juha Ratilainen 09 Sep '10

09 Sep '10

Greetings, Hope this is a correct place for these questions. I'm trying to utilize a smart token for various purposes, ultimately I'd like to have a single token for login, encrypting data either with FileVault or specific disk image, and VPN connection. FWIW, I'm using Charismathics CSSI, their tokend and plug'n crypt tokens. We are utilizing Open Directory, but having a lot of mobile users for which I'd like to use portable account (no synchronization). I have run into various problems with these aims and I'm hoping that someone could help with these. 1) I can use sc_auth to bind a token for login to an account. After that, I can also set screen to lock with token removal. However, after screen is locked I cannot use token's PIN anymore for login, only password is accepted even if I plug the token back. 2) tokenadmin create-fv-user fails for creating FileVaulted new account. sudo tokenadmin -v create-fv-user -u tokenuser -l "Token User" gives output: create-fv-user "-u" "tokenuser" "-l" "Token User" Authorizing right system.preferences.accounts Connecting to writeconfig... Connected Validating full name: Token User Validating short name: tokenuser 2010-09-07 13:00:17.908 tokenadmin[42782:e07] failed to convert string tokenadmin: Creating user "Token User" (tokenuser) Creating new user account: tokenuser 2010-09-07 13:00:18.354 tokenadmin[42782:e07] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '*** -[NSPlaceholderString initWithString:]: nil argument' *** Call stack at first throw: ( 0 CoreFoundation 0x00007fff85e95cc4 __exceptionPreprocess + 180 1 libobjc.A.dylib 0x00007fff85aa90f3 objc_exception_throw + 45 2 CoreFoundation 0x00007fff85e95ae7 +[NSException raise:format:arguments:] + 103 3 CoreFoundation 0x00007fff85e95a74 +[NSException raise:format:] + 148 4 Foundation 0x00007fff81819aaa -[NSPlaceholderString initWithString:] + 102 5 Foundation 0x00007fff81835e01 +[NSString stringWithString:] + 45 6 Admin 0x00007fff865d8274 -[User setPassword:] + 79 7 tokenadmin 0x0000000100001774 0x0 + 4294973300 8 tokenadmin 0x0000000100001085 0x0 + 4294971525 9 tokenadmin 0x0000000100000c8c 0x0 + 4294970508 ) terminate called after throwing an instance of 'NSException' Abort trap bash-3.2$ 2010-09-07 13:00:20.419 writeconfig[42783:903] writeconfig quitting because of exception:connection went invalid while waiting for a reply If I add -p, for optional password, a different error, this time account is created but creating sparsebundle fails: create-fv-user "-u" "tokenuser" "-l" "Token User" "-p" "tokenuser" Authorizing right system.preferences.accounts Connecting to writeconfig... Connected Validating full name: Token User Validating short name: tokenuser tokenadmin: Creating user "Token User" (tokenuser) Creating new user account: tokenuser Creating home directory... 2010-09-07 13:02:35.890 writeconfig[42815:903] DIHLFVMount failed with 80 tokenadmin: Failed to create home directory New user account created and configured 2) I could do without FileVault if I could create an encrypted image bound to token certificate. However, I haven't found an option to do this. hdiutil can create an encrypted container with path to a certificate as an argument. However, it doesn't understand a reference to a keychain that is a token. Any suggestions to overcome this? Thank you in advance for any replies, Juha Ratilainen

2 2

Help With Open Directory
by iTanakh Support 08 Sep '10

08 Sep '10

Hello, I purchase a blink (contact-less credit card or smart card) reader, and I was wondering if I can use a credit card to login to the server admin account. The reader is a SCL010 Smart Card Reader - SCM Micro Smart Card USB, purchased from antarespro dot com. I still haven't received it but I need help with middleware and software. Thanks, Nathan Niamehr

1 0