February 2013 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

Possible Stupid question
by John Daly 22 Feb '13

22 Feb '13

Greetings all, I looked on the documentation at macOS Forge, and haven't found a great answer: I have an Open Directory setup and need to configure it so that users can log into their accounts using their smart card. So far, I've not been able to get this to work, and haven't been able to find a good set of instructions for doing so. Shawn's answers indicate that it's possible and perhaps considered such an easy, obvious, task that it doesn't require directions, but I'm one of the RTFM kinda guys, so I'd like to find the manual so I can read it. Thank you, John

2 1

Dowloading Error
by Carlsen, David D MAJ RET 22 Feb '13

22 Feb '13

Hello List, I tried downloading the Mt Lion smart card code, but keep getting an error saying the file is damaged and needs to be put in the trash (see attached). I thought maybe not having the certs was the problem, but I get the same error after installing them. - OSX Version 10.8.2 - 2.8 Ghz Intel Core 2 Duo MacBook Pro - 8GB RAM Any help will be appreciated. Regards, Dave -- David D. Carlsen, Ph.D. Contractor, Kratos Government Solutions TCM Networks & Services Fort Gordon, GA 30905 david.d.carlsen.ctr(a)mail.mil dave.carlsen(a)us.army.mil 706-231-9784 (Mobile)

2 2

CAC login on OS X 10.7 & 10.8
by Michael Kluskens 21 Feb '13

21 Feb '13

1) I cleaned installed and updated OS X Lion on a unused disk. 2) I installed the SmartCardServices Installer v2.0.b2 for Lion 3) I used sc_auth hash and selected the first hash for use with sc_auth accept -u useraccount -h ... 4) I confirmed the hash entry with dscl . -read /Users/useraccount 5) I added builtin:smartcard-sniffer,privileged to both the system.login.console and authenticate sections of /etc/authorization Confirmed that my Gemalto CAC card works with OS X Mail and Safari, log out and insert card, no effect, reboot, insert card, no effect. What step did I miss? I was never inserting a reader / card on a vanilla install of OS X Lion. Are there newer instructions on the precise location for the smartcard-sniffer entries? What log files do I look at, secure.log seems related but I can't tell if anything in there was an error. > There are three methods for associating a Smart Card to a given user account in either the local or remote DS. > PubKey Hash - Default method used by OS X and requires sc_auth > Attribute Matching - requires /etc/cacloginconfig.plist > PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC > All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. > Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. > Project Site: > http://smartcardservices.macosforge.org/ > > Installers: > http://smartcardservices.macosforge.org/trac/wiki/installers > > There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. >

1 2

Help with token detection and certificates retrieving
by Bernardo Höhl 20 Feb '13

20 Feb '13

Dear friends from list, I am a new bye in smartcards. I have written an app that invoices under the brazilian invoicing project. At this moment I can only use certificates as files, I dream my app could one day use smart cards and tokens. I am trying to write a small concept project to help me detect when a token is inserted and retrieve the token contents (certificates) for signing XML files and SOAP messages. If you could please take a look at the attached project and help me achieve its funcionality, I will be very thankfull. Thank you for reading. Bernardo Höhl Rio de Janeiro - Brazil =============================== PN: I am not a rich man, but I can afford a small payment for helping me, or send you a nice present from Brazil.

1 0

Problem with Smart Card Services Update 2.0b2-ML-signed
by Boško Ivanišević 14 Feb '13

14 Feb '13

I had problems with Gemplus GemPC smart card reader and I tried to solve it by installing Smart Card Services Update 2.0b2-ML-signed.pkg on OS X 10.8.2. After installation my lock screen dialog box has changed from small one to the standard, large. In addition when ssh key is loaded it is sometimes impossible to type in password (characters are typed in the terminal windows). I would like to uninstall this package. Can somebody help me with this? I cannot find a way to uninstall Smart Card Services. -- Bosko

1 0