May 2013 - SmartcardServices-Users - lists.macosforge.org

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

Mountain Lion Login window
by Jorgensen, Will A 25 Jul '13

25 Jul '13

I'm trying to get a PIV card working for login on mountain lion. I installed the tokend and driver for the reader. When I'm already logged in, the PIV card shows up in the keychain and the certificates show up as valid (I had to install some root certificates to get that). I've used sc_auth to enable the certificate for a local account. I've tried enabling and disabling the cacloginconfig.plist (my understanding is it should be disabled when logging in to a local account). However, under no circumstances have I been able to get a prompt to appear at the login window. I've tried switching back and forth between username/password and list of users views to no affect as well. I'm new to the list and I did some searching in the archives, but I was having trouble dealing with .gz files so I didn’t find much. If this is a question that has already been answered I apologize. Thanks for your help. __________________________________________________ Will Jorgensen Desktop and Mobile Services Pacific Northwest National Laboratory

5 7

Smart Card Services Update v2.0.b2-MtLion -> downloaded package treated as damaged
by Disiena, Ridley (GRC-VG00)[DB Consulting Group, Inc.] 27 May '13

27 May '13

Greetings, I was wondering if there is a current Gatekeeper bug that I am not fully aware of. I am trying to download -> (1) **NEW** Smart Card Services Update v2.0.b2-MtLion (Sep 18, 2012) Even with the signing certificate present on the system, unless the settings for Gatekeeper in Security and Privacy are set to "Anywhere", the package will not run. It always gets: "“Smart Card Services Update 2.0b2-ML-signed” is damaged and can’t be opened. You should move it to the Trash." The reason I believe this to be a Gatekeeper issue is because this only happens if the package was obtained recently from the internet via OS X. I have a local copy which I had backed up from some time before this started occurring, I assume an OS X update. The backed up version has the same SHA-256 hash as the downloaded package. I can install that package on any setting in Gatekeeper even "Mac App Store" which is odd. Any comments or suggestions on this issue? Is there a bug report already open? -Ridley

2 4

How to access an ST-1044U?
by Douglas Wayne 25 May '13

25 May '13

I bought a CHERRY SmartTerminal ST-1044. I installed both the API from the "software" directory on the CD that came with it, along with the driver off their website. The driver was labeled "MacOS CCID, PC/SC driver V3.1.0.2 - Release: 02/14/2012 - 175 kB - MacOS X 10.5.x, 10.6.x and 10.7.x on Intel". FWIW, I'm on MacOS X 10.8. The device shows up in "about this mac" as "SmartTerminal XX44". When I insert a card, the green light briefly blinks red and goes back to green. In system console, I see "5/19/13 10:37:38.487 AM com.apple.SecurityServer[19]: token in reader Cherry SmartTerminal XX44 00 00 cannot be used (error 229)" Really, all I want to do is read all the bytes out of a smart card and be able to modify arbitrary bytes. I'd be very happy if the device showed up as a block device in /Volumes or something. I've tried installing some other software, such as from http://smartcardservices.macosforge.org/trac/browser/trunk/Tokend/PKCS11and http://www.gemalto.com/products/dotnet_card/resources/libraries.html So I'm just stabbing in the dark and probably making the situation worse. :) Anyone out there have any recommendations? Thanks, Douglas

2 1

Request for assistance
by Tim and Deana Woliver 25 May '13

25 May '13

I attempted to download the Smart Card Services Update v2.0.b2-MtLion. (http://smartcardservices.macosforge.org/trac/wiki/installers) When I opened the downloaded file, I first received a dialogue window that says the package was signed with a certificate that has expired. If I acquired this package recently, it may not be authentic. Did I want to continue with the installation anyway? I selected "Continue". I then clicked "Continue" on the "Smart Card Services Update 2.0" and everything initially looks like the the utility will load just fine after clicking the next series of "Continue" buttons. The last "Continue" is one the "Custom Install" window. The only option unchecked is "cacloginconfig" I left it unchecked the first attempt, although I selected it on a subsequent attempt to no avail. After clicking "Install" the process resolves to "There were errors with the installation. You may want to try installing again." "The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance." I'm probably missing something simple and easy. Request any suggestion for fixes or work-arounds so I can use my CAC/reader on my Mac. Vr, Tim

2 1

"Unidentified Developer" error when opening installer?
by Jim Thomas 10 May '13

10 May '13

Shawn, I noticed this with our own installers, and in troubleshooting, found it with yours, too. With Gatekeeper set to default, double-clicking the signed installer pkg results in the following error: ---------------------------------------- "Smart Card Services Update 2.0b2-ML-signed" can't be installed because it is from an unidentified developer. Your security preferences allow installation of only apps from the Mac App Store and identified developers. ---------------------------------------- Any insight would be appreciated. Regards, Jim Thomas, CSCIP/G

2 5