March 2012 - SmartcardServices-Users

/etc/authorization for OS X Lion ?
by Yoann Gini 09 Mar '12

09 Mar '12

Hello, I’m new on this mailing list and I think a lot of people already ask that, but I’m looking for a solution for OS X Lion logon with smartcard. I’ve installed SmartCardService and OpenSC, my smartcard reader is see by my system, I can configure my cards with it, the keychain can see it too and mail can sign outgoing mail with it, so everything goes well when the user is logged. Now I try to allow user to be authenticated by the login window with the smartcard and I can’t find any documentation for the modification of /etc/authentication database… Someone have a link for that ? With 10.7.3 it’s seems to work, at least Centrify has do it : http://community.centrify.com/t5/The-Centrify-Apple-Guy/OS-X-10-7-3-and-Sma… So we should be able to do that with OpenSC devices ? Best regards, Yoann Gini

1 0

Smartcard Login and Kerberos (UNCLASSIFIED)
by Bruno, David L CIV (US) 07 Mar '12

07 Mar '12

Classification: UNCLASSIFIED Caveats: NONE Hello, Due issues with smartcard Login in 10.7.3 we cannot solely deploy it as the only means of authentication. In Snow Leopard I was never able to get smartcard login and Kerberos to work together. Does anyone know if this has changed in Lion 10.7.3? Has anyone successfully setup smartcard login as well as Kerberos login? Thank you _______________________ David Bruno Security +, RHCT, CCNA, CCA Computer Scientist U.S. Army Research Laboratory Scientific Computing Branch 410-278-8929 david.bruno(a)us.army.mil Classification: UNCLASSIFIED Caveats: NONE

1 0

Continuously having to delete Microsoft Intermediate Certificate
by Jenny Matheney 05 Mar '12

05 Mar '12

0"¢ *H÷ "0"10 +0) *H÷ Content-type: multipart/alternative; boundary="B_3413791661_1622329" > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3413791661_1622329 Content-type: text/plain; charset="ISO-8859-1" Content-transfer-encoding: quoted-printable I have spent a ton of time on the internet, Fed-talk, SmartcardServices and other communities over the past couple of months trying to figure this one out... And perhaps a keychain forum would be a better one to ask this question of but since Shawn seems to be the all knowing god of SmartCard/Keychain/Authentications/etc... ;-) I=B9m reeeeeaaaaalllllly hoping this forum has the answer. So! Here goes. I am using Entourage as my mail client to connect to webmail.east.nmci.navy.mil. I started receiving an error =B3unable to establish a secure connection to <servername> because the root certificate is not installed.=B2. Then every time I would receive an email from any .mil account I would get this pop-up that said verifying certificates that would hang and then of course report back there is a security problem. Click on details and get a red X =B3You do not trust the digital ID=B2. I followed ever= y line of advice I could find with the only solution that worked being to delete my Microsoft Intermediate Certificate. This works for a little whil= e but then an email will come in that causes this problem to reappear. And off I go back to my Username>Library>Keychains> to drag the Microsoft Intermediate Certificate to the trash again. I=B9m sure I=B9m not doing myself any favors by continuously deleting this either.... There has to be a more elegant solution out there... It=B9s hugely annoying in Entourage but causes problems when I OWA in properly using Safari or FireFox as well. Is there a method for identifying the offending keychain and deleting/blocking it from ever appearing again? Help? I hope you guys have an answer for me and thanks for your time. Jenny ~KCCO --B_3413791661_1622329 Content-type: text/html; charset="ISO-8859-1" Content-transfer-encoding: quoted-printable <HTML> <HEAD> <TITLE>Continuously having to delete Microsoft Intermediate Certificate</TI= TLE> </HEAD> <BODY> I have spent a ton of time on the internet, Fed-talk, SmartcardServices an= d other communities over the past couple of months trying to figure this one= out... And perhaps a keychain forum would be a better one to ask this quest= ion of but since Shawn seems to be the all knowing god of SmartCard/Keychain= /Authentications/etc... ;-) I’m reeeeeaaaaalllllly hoping this forum h= as the answer.  So!  Here goes. I am using Entourage as my mail client to connect to webmail.east.nmci.navy= .mil.  I started receiving an error “unable to establish a secure= connection to <servername> because the root certificate is not instal= led.”.  Then every time I would receive an email from any .mil ac= count I would get this pop-up that said verifying certificates that would ha= ng and then of course report back there is a security problem.  Click o= n details and get a red X “You do not trust the digital ID”. &nb= sp;I followed every line of advice I could find with the only solution that = worked being to delete my Microsoft Intermediate Certificate.  This wor= ks for a little while but then an email will come in that causes this proble= m to reappear.  And off I go back to my Username>Library>Keychain= s> to drag the Microsoft Intermediate Certificate to the trash again. &nb= sp;I’m sure I’m not doing myself any favors by continuously dele= ting this either.... There has to be a more elegant solution out there... It= ’s hugely annoying in Entourage but causes problems when I OWA in prop= erly using Safari or FireFox as well. Is there a method for identifying the offending keychain and deleting/block= ing it from ever appearing again?  Help? I hope you guys have an answer for me and thanks for your time. Jenny ~KCCO </BODY> </HTML> --B_3413791661_1622329-- `00ð õ0 *H÷ 0]10 UUS10U U.S. Government10 UDoD10 UPKI10UDOD EMAIL CA-240 100422000000Z 130421235959Z0w10 UUS10U U.S. Government10 UDoD10 UPKI10 UUSN1$0"UMATHENEY.JENNY.A.10702820260"0 *H÷ 0 ©FMVR@æÀÐ d_5%<B*MŸlqšñ »ZŠ #ÒÊÊWa»³- oãI.=DêNdg?Á#c[€úà°ÏNu®Ns$ã_Ÿµl$iœÊ^H³Àêº°è`ìo1Û3Ešý¬F6l>pê1©€âé'Ê=¡Ð<àpõ%Gà4\džîuµâÐÛô1¿}KÉ:,_ßí$ÅâpvöÎÔUÃÚéLËö)ÂÂëit V'µ¶ty|,W®[5ŽV!üÝö¬CpçÁ©$áòCø>HöÍ!"[£µ0±0U#0Tªs*Ç³wêÍ"@yH{û§"0?U80604 2 0.http://crl.disa.mil/getcrl?DOD%20EMAIL%20CA-240UÿÀ0#U 00 `He 0 `He0UQ ÖQì4êO_âïžÁw0m+a0_0;+0/http://crl.disa.mil/getsign?DOD%20EMAIL%20CA-240 +0http://ocsp.disa.mil0BU;09jenny.matheney(a)navy.mil +7 1070282026@mil0U 00+ 1US0)U%"0 +7++0 *H÷ m$2)qvÒCë~€X#üºz\€#¶ÉzTý4ÔS1ê©MÑÀ8]Ú¯ÏU»R²!ÉØ1Ë±ÛüìÝ+Fš¯r?L;Ûä8üxgj#kÿ|ãVêÕd(Ê[œô¯+Ÿ|$BÏY+eH@êÓ&`¿Ë×$Gy¬O°8N$Q`Frm(G°OCÖÆi_>ä§`±Úb#Å*cÂ&€·8B).6s©ý@[§Z¢Û|?ÀM»ºqÁÄB m®¡ØW«%9Gy¶ãá"çðR$ñÿÝ& ±¥ Kù¬Îº00w E0 *H÷ 0[10 UUS10U U.S. Government10 UDoD10 UPKI10U DoD Root CA 20 090126202615Z 150125202615Z0]10 UUS10U U.S. Government10 UDoD10 UPKI10UDOD EMAIL CA-240"0 *H÷ 0 ¥.Xz¡Þæ[öñÕÔÜ5#{n(dtp<ÌÂt<9! N ×7šÒÉÆ'(úU×²Î2Œðyõh«.ÌÏ7²ø eI %ÁŒj BmŽ¡B"«Ú9^Wk`Þ~hj~Aõ8zý²ÒâK6b¶ì%»Ð§£ÍQš÷ÒyU4&£ä\Í»h&t 7¡æ¯Íä>GÿÂGŒeº2)£ðÂ¢[zê²J}ÆÃn¬œO©v:=,*0Ž÷È Ò:|ÐZµú 0~ÖÑÇ¶C'±(©ã³xßbdENÍ¯®X6ß£Z0V0Uÿ0U#0It»^ºzþTï{ ÆÆ p0UTªs*Ç³wêÍ"@yH{û§"0U$00Uÿ0ÿ0U 00 `He0 `He 0 `He 0 `He0 `He0 `He0 `He0 `He0 `He0 `He 0 `He0?U80604 2 0.http://crl.disa.mil/getcrl?DoD%20Root%20CA%2020þ+ñ0î0?+… +0http://ocsp.disa.mil0+0|ldap://crl.gds.disa.mil/cn%3dDoD%20Root%20CA%202%2cou%3dPKI%2cou%3dDoD%2co%3dU.S.%20Government%2cc%3dUS?cACertificate;binary0 *H÷ rÜ9scMé7Ï²íØM÷2J³Êºó¬qf1Š*œº}TØ/ cJèl¡ì^{V0-ÈÒí×GDiÏoËØçRuµQÈªið0ðÇ6œÎÞ;vý ÎË¶ºÖñ\Ê¯èš¬-ÖvPì6ú£ßÆ2êÇsFü/Äè'HÂF6öìíg2ž¢à·Ò^!aCl}ó;keíãÛšÿÅ²çë_îï¿ó9³õÒÕÃlJ:l?¯è[6[Š&FFkÇÔªç®ž+Nú!r_¯Žî[É)|éÜxâNàtÒxf¢Çš0œ0¥ õ0 *H÷ 0]10 UUS10U U.S. Government10 UDoD10 UPKI10UDOD EMAIL CA-240 100422000000Z 130421235959Z0w10 UUS10U U.S. Government10 UDoD10 UPKI10 UUSN1$0"UMATHENEY.JENNY.A.10702820260"0 *H÷ 0 À 2S»äÇtÆ u€'^µV¥±b*³ŸîMB°4 -Ô D/zÈ;ü'TÖÐ~wÚ×\xPÆpŒÊJéŒ»ÎÈK¯át°ùoRÂœÅËT*2cÂ?ŽF²Y*É±ó#¯Òp`ÏÑÄ·)]èÎQO38ÞOéÑË!¬7b-XØ{dcÓrwl?OÈŽä£â.ä»As&KÙóŸrpÈÛõp`IKS©(|s9_Î_Pd€¬8€ Ñ¥·~*Ùæ¯ÞAl7ÃMÔW&®9Uûb:]«RÑ6ß9sÍ©)ÝÉv9,B\£j0f0U#0Tªs*Ç³wêÍ"@yH{û§"0?U80604 2 0.http://crl.disa.mil/getcrl?DOD%20EMAIL%20CA-240Uÿ 0#U 00 `He 0 `He0Uµ{ ädToIüfÿåXðx0m+a0_0;+0/http://crl.disa.mil/getsign?DO… +0http://ocsp.disa.mil0"U0jenny.matheney(a)navy.mil0U 00+ 1US0 *H÷ inPÒnm(C §d+CW¯6_Ž=b¬JÏGqÐ(IG ªÅÒ*IÒîÈ©ñJMÃÑy}DÅÿÚ x\iÂÏÒ^òÅe»<©·ºµ1wö·µ0æåfæ\¢ê(äCq ÏÌ5ì??âíCVíB0hj¢wæbÐcë ÓÅëgÂ'"£â'/¿RõwMÝ .FÞÞ!ÁÃY¥-êHÌdV10Žâ8=fq:ŽÙphŠ€æŽêYîo)^{"=êŠkÂœ:aÜ>-ðüÕôKNÌtNl ÛŒ©)vÂ€ÀøCæ1ê0æ0d0]10 UUS10U U.S. Government10 UDoD10 UPKI10UDOD EMAIL CA-24õ0 + ]0# *H÷ 1€dÑ.¬aö gpÛ Wpœ0 *H÷ 1 *H÷ 0 *H÷ 1 120305172741Z0 *H÷ -1ËñÍânw ~€ŠG¬-â±f í¯7'üd<ÖO{øâ×å©¶õŽ|GÝ€nRGÀ»Z}%³ê³ž'9¿ØËMÉp§æÞå/3ih?žÑð£¬Ñn'£ð{ÖBÜÑ€Ë$ýå<ôWpCBÞ©óê€{Ä»1wY0ÚÂÂgÁ5ªíœ7t0G¬ö²c+I:-ñz8¥7#Þ±¢"¯ê;Wmd%ØNÄ2óð0`e-wÿSs~ÛBD5E88éWÇ3E·"XÌeªå¢ ÏÈ@¯ïìÿ"ÉOhšìÏ6

2 1

Searching Directory Services for certificates in Lion
by JEFFREY COMPTON 05 Mar '12

05 Mar '12

Is anyone else having trouble with Mail.app in Lion searching directory services for certificates? From command line - it works like a charm - for example -- security find-certificate -e mycoworker(a)ourdomain.org -p > downloadedcert.pem; security import downloadedcert.pem -k login.keychain But from Mail.app - no go. Even searching the contact in the GAL displays the correct cert for the contact. Thanks.

4 4

Storing Keychain data
by SB Tech 04 Mar '12

04 Mar '12

Hi, I looked into using a Smart Card for authentication purposes in my SOHO, but came away disappointed by its interaction with Keychain Access. Specifically, because it took the top position in the Keychain list, it assumed the Login keychain's duties; but because I was unable to store passwords directly on the Smart Card (eg. wifi passwords) I found myself having to authenticate a second time, to the Login keychain. In the meantime, there was no automatic authentication of login services such as connecting to wifi or mounting of secure disk images. So, my question is: how does one go about using a Smart Card to store Keychain Access-specific data, so that the Smart Card "dynamic keychain" can more fully perform the functions required on login? At the moment, I'm not concerned with any particular Smart Card or software solution, I'm more interested in knowing whether it's actually possible. Regards.

5 10