January 2013 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] EAP-TLS Authentication with CAC on iPad or iPhone
by Shawn Geddis 30 Jan '13

30 Jan '13

Henry, I do agree this belongs on a developer list and have included the SmartCardServices-Users and Tokend-Dev lists here. I will quickly try to address your items and this can continue on the other lists (other than Fed-Talk). On Jan 30, 2013, at 1:42 PM, "Henry B. Hotz" <hotz(a)jpl.nasa.gov> wrote: > On Jan 24, 2013, at 8:51 AM, Shawn Geddis <geddis(a)apple.com> wrote: >> OSX's Smart Card Services are backed by CDSA, which everyone should know was deprecated with the release of OS X Lion v10.7. On OS X, all of the architectural components are still there except the Tokend modules installer needs to be downloaded from our SmartCardServices Project @ MacOSForge.org as well as the need to add the authentication mechanism line back into /etc/authorization. Commercial products are also available to augment or replace what continues to be available from MacOSForge.org. > > Maybe this question belongs on a development list, but I'm not clear about what this means. From an architectural/development point of view, how much of the infrastructure has gone away? As of OS X 10.8.2, even though CDSA & Tokend were Deprecated, Nothing has "gone away". After installing the Tokend modules from MacOSForge.org and modifying your /etc/authorization file accordingly, you have everything that was there before. Architecturally, everything is there! Developers providing Tokend support can still rely on the architecture as it still exits today. Other commercial developers have chosen to augment their products with components that replace what is built-in to OS X (ie. Tokend modules). > Without tokend's, are keychains still supported? "Keychains" are an abstraction of a Key Store. Smart Cards are still available as keychains because of the Tokend abstraction. If you take the Tokend out of the equation or do not have a Tokend installed corresponding to your desired Smart Card then No, the smart card would not appear as a keychain -- that has been the case since day 1. > (Do smart cards still look like funny-named keychains?) Funny Named ? The name depends on the Smart Card in use and what logic the Tokend developer chooses to use for Keychain naming. From Apple, we provided a name that began with the card type (ie. "CAC-", "CACNG-", "PIV-", "BELPIC-") and then the unique card identification. > Can you still daisy-chain keychain entries so one keychain entry can say to use another keychain for some specific thing? You are referring to the use of the CLI command "systemkeychain" Usage: systemkeychain -C [passphrase] # (re)create system root keychain systemkeychain [-k destination-keychain] -s source-keychain ... systemkeychain -T token-protected-keychain-name man page... SYSTEMKEYCHAIN(8) BSD System Manager's Manual SYSTEMKEYCHAIN(8) NAME systemkeychain -- creates system keychains and allows keychains to unlock keychains SYNOPSIS systemkeychain [-fv] [-k filename] [-C] [password] systemkeychain [-fvc] [-k filename] [-s] [file ...] systemkeychain [-v] [-k filename] [-t] DESCRIPTION The systemkeychain can be used to create a system keychain, make it pos- sible for a keychain to unlock another keychain, or test unlocking a key- chain. .... > There were thousands of pages of documentation for CDSA. While I was never up for reading them, it looked like it should be possible to associate Apple functionality with CDSA if you looked. The Apple doc's always seemed disjoint, and sparse on details. Without CDSA I'm left feeling like I can't find enough information to actually understand Apple's functionality. If you are only know trying to understand Apple's implementation of CDSA (which by the way is a specification managed by the OpenGroup), I would say it is too late. it was deprecated in OS X Lion and there is no guarantee it will exist in a future version of OS X. OS X has provided the "Keychain APIs" for the 99+% of developers that just need to deal with the objects on the cards. Only middleware developers had to deal with CDSA directly. > Of course, maybe the real answer will depend on what happens in the validation process. *sigh* Validation of what ? >>> Given ubiquitous PKI support, the card should, IMO, be just an OS device driver issue, not an application issue. >> >> I would agree that it would be very nice to rely on integrated services for use of various hardware tokens. I will strongly disagree that it is simply a device driver issue -- tight integration like smart cards have on OS X does not come through the OS vendor simply dropping in a device driver - it is much more than that. > > Yeah, "device driver" is oversimplified. I meant the whole PIV/CCID/USB/(pcscd/tokend?)/keychain(or pkcs11) support stack. Given the OS has a ubiquitous API for interfacing with PKI credentials, the card should be supported by that API and not require every single application to write special card support code. CCID, USB, PCSCD, Tokend... are all part of the "Smart Card Services"... As noted above...OS X has provided the "Keychain APIs" for the 99+% of developers that just need to deal with the objects on the cards. Only middleware developers had to deal with CDSA directly. - Shawn ________________________________________ Shawn Geddis Security Consulting Engineer Apple Enterprise Division

1 0

Re: [SmartcardServices-Users] SmartcardServices-Users Digest, Vol 36, Issue 5
by Trinity Peterson 28 Jan '13

28 Jan '13

Shawn, Everyone who helped was fabulous. This is a great site and I am glad I can follow it and hopefully learn more about making my mac better. I am making a installation guide for some of my co-workers who are not as computer savvy. I can post it here as well if you would like a look at it? Thanks! Trinity On Jan 25, 2013, at 9:00 PM, smartcardservices-users-request(a)lists.macosforge.org wrote: > Send SmartcardServices-Users mailing list submissions to > smartcardservices-users(a)lists.macosforge.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.macosforge.org/mailman/listinfo/smartcardservices-users > or, via email, send a message with subject or body 'help' to > smartcardservices-users-request(a)lists.macosforge.org > > You can reach the person managing the list at > smartcardservices-users-owner(a)lists.macosforge.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of SmartcardServices-Users digest..." > > > Today's Topics: > > 1. Re: Help (Shawn Geddis) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 25 Jan 2013 13:02:21 -0500 > From: Shawn Geddis <geddis(a)apple.com> > To: Trinity Peterson <trinity.peterson(a)gmail.com> > Cc: smartcardservices-users(a)lists.macosforge.org > Subject: Re: [SmartcardServices-Users] Help > Message-ID: <9450E4BE-54B5-401E-A07F-9F5773AB5C43(a)apple.com> > Content-Type: text/plain; charset="us-ascii" > > Trinity, > > Glad to hear that you got it and thanks to the others for jumping in and helping. I'll make sure we do a write-up on the adding of certificates to the keychain, so this does not cause you or others problems moving forward. Sorry you experienced that issue. > > On Jan 23, 2013, at 5:21 PM, Trinity Peterson <trinity.peterson(a)gmail.com> wrote: >> Chris, > >> > >> Thank you. Took some time for me to figure out how to install the certificate, but once I did that the installer loaded. I appreciate your and David's help! I'll have to see if it works from here... > >> > >> Trinity > > - Shawn > ______________________________________________________ > Shawn Geddis geddis(a)me.com > Enterprise Security Consulting Engineer, Apple geddis(a)apple.com > > MacOSForge: Smart Card Services Project Lead: > Web: http://smartcardservices.macosforge.org/ > Lists: http://lists.macosforge.org/mailman/listinfo > ______________________________________________________ > > > > > > > > > >

2 1

Re: [SmartcardServices-Users] Help
by Trinity Peterson 25 Jan '13

25 Jan '13

Chris, Thank you. Took some time for me to figure out how to install the certificate, but once I did that the installer loaded. I appreciate your and David's help! I'll have to see if it works from here... Trinity

2 1

Re: [SmartcardServices-Users] Help
by Trinity Peterson 23 Jan '13

23 Jan '13

Yes. I looked through your ticket and the symptoms seem the same to me. I am not sure what details to add or if I can add them. I would really just like to be able to work on classes that require CAC access from home. Trinity

2 1

Re: [SmartcardServices-Users] Help
by Trinity Peterson 23 Jan '13

23 Jan '13

David, I am a new MAC user... Love it, by the way. I could do this on my pc easily. I did change the preference security setting to install programs from "anywhere" and the installer loaded, but it could not complete. I just get a message that "The installation failed. The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance". Trinity

2 1

Help
by Trinity Peterson 23 Jan '13

23 Jan '13

I am trying to install (1) **NEW** Smart Card Services Update v2.0.b2-MtLion on my computer. I have downloaded it several times now and every time I try to install it it gives me the same error: I have installed the root certificates linked in the installer. I am trying to use an IOGear GSR202 card reader. This is the only reader I have found locally. Any help you might be able to provide would be greatly appreciated. Trinity

2 1

CAC Login ?
by Barry McInnes (NOAA Affiliate) 02 Jan '13

02 Jan '13

Hi, I had a quick look through the archives, but could not find anything related. I have installed Smart Card Services Update 2.0b2-ML-signed package, and the SmartCard is visible when inserted (attached). I selected the optional install of cacloginconfig, but cannot find the CACLoginConfig.plist file. I am trying to authenticate via Active Directory. Is there a FAQ anywhere on how to set this up ? thanks barry -- Barry McInnes 325 Broadway Boulder CO 80304 (303)4976231 barry.j.mcinnes(a)noaa.gov

1 0

Slightly off-topic: CAC reader co-site interference?
by David Emery 02 Jan '13

02 Jan '13

I got a wireless induction charging unit for my Apple Magic Mouse (http://store.apple.com/us/product/H4825ZM/A/mobee-magic-charger-for-apple-m…) This was located next to my (SCR 3310) CAC reader. When I tried to log into Army AKO using CAC, I got a certificate error. Moving the CAC reader away from the charging station fixed the problem. I thought this observation might be of interest.... dave

5 4