July 2013 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

Mountain Lion Login window
by Jorgensen, Will A 25 Jul '13

25 Jul '13

I'm trying to get a PIV card working for login on mountain lion. I installed the tokend and driver for the reader. When I'm already logged in, the PIV card shows up in the keychain and the certificates show up as valid (I had to install some root certificates to get that). I've used sc_auth to enable the certificate for a local account. I've tried enabling and disabling the cacloginconfig.plist (my understanding is it should be disabled when logging in to a local account). However, under no circumstances have I been able to get a prompt to appear at the login window. I've tried switching back and forth between username/password and list of users views to no affect as well. I'm new to the list and I did some searching in the archives, but I was having trouble dealing with .gz files so I didn’t find much. If this is a question that has already been answered I apologize. Thanks for your help. __________________________________________________ Will Jorgensen Desktop and Mobile Services Pacific Northwest National Laboratory

5 7

SuisseID on 10.8
by Stephan Rickauer 15 Jul '13

15 Jul '13

Hello list, I am trying to get local logon to work on 10.8 using the SuisseID smartcard [1] (not using anything fancy like a Domain, LDAP or whatnot, just plain local fun). What I've done so far: - created a dedicated user called 'sc' - installed Smart Card Services (needed?) - listed available hashes with sc_auth: $ sc_auth hash | grep SwissSign 607BD6C553D5BB8D654AB94AFFBB7C5521D8FBD1 SwissSign_dataEnc AA779E7AD6DBB45AFCA48C64F1118E115DFB5604 SwissSign_nonRep B6EFD1C9C5DA0D4B70E18B580BD22757D53D79AA SwissSign_digSig 607BD6C553D5BB8D654AB94AFFBB7C5521D8FBD1 SwissSign_dataEnc - and assigned the right one to user 'sc': $ sc_auth list -u sc B6EFD1C9C5DA0D4B70E18B580BD22757D53D79AA - properly edited /etc/authorization according to [2] When the logon screen appears and the SuisseID USB stick is plugged in, the screen switches to PIN entry mode. However, the PIN entered would not work (even though it is correct, keyboard mappings can be ruled out, too). The system.log states: Jul 15 14:06:09 macmini.local com.apple.SecurityServer[15]: Token reader ACS ACR 38U-CCID 00 00 inserted into system Jul 15 14:06:14 macmini.local com.apple.SecurityServer[15]: token inserted into reader ACS ACR 38U-CCID 00 00 Jul 15 14:06:16 macmini.local com.apple.SecurityServer[15]: reader ACS ACR 38U-CCID 00 00 inserted token "SwissSignID" (SwissSignID-7bff2081ef0c1920) subservice 2 using driver com.cryptovision.scinterface.tokend Jul 15 14:06:16 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:16 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:16 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:16 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:24 macmini.local SecurityAgent[113]: User info context values set for sc Jul 15 14:06:24 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:24 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:24 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:24 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:31 macmini.local SecurityAgent[113]: User info context values set for sc Jul 15 14:06:31 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:31 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:31 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:31 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:33 macmini.local SecurityAgent[113]: User info context values set for sc Jul 15 14:06:33 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:33 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:33 macmini.local authorizationhost[112]: validate chain started Jul 15 14:06:33 macmini.local authorizationhost[112]: validate chain completed with: 4 Jul 15 14:06:35 macmini.local com.apple.SecurityServer[15]: Token reader ACS ACR 38U-CCID 00 00 removed from system [...] [3] claims that status code 4 is a good sign, but that doesn't get me any further either. Could anyone point me into the right direction, please? Thanks a lot! Stephan [1] http://postsuisseid.ch/de/documents/doc_download/43-suisseid-specification [2] http://blog.inig-services.com/archives/1068 [3] https://discussions.apple.com/thread/3757421

1 0

Download Failure
by Scott Irwin 05 Jul '13

05 Jul '13

I am trying to download Smart Card Services Update v2.0.b2-MtLion on my MacBook Pro running 10.8.4. I've tried both Safari and Firefox. After agreeing to the to all conditions for the installation, the summary screen returns "The Installation Failed. The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance." Any suggestions? Thanks -P

1 0

CAC Card Issue
by c 05 Jul '13

05 Jul '13

I have a macbook pro with OS X 10.8.4 installed. I downloaded the installer from the website and had no problems. However I was issued a new CAC card - Oberthur ID one 128 v5.5. I cannot access any of the prior sites I used to be able to access. When I go to keychain access I can see the card, It says CAC followed by a bunch of numbers. When I click to unlock it asks for my keychain password but will not open. The card works fine on my Windows computer but I can't use on my mac. Any suggestions? Thank you, CK

2 1

Problem installing Smart card services update 2.0b2
by Walton, Ben 01 Jul '13

01 Jul '13

Hi, I recently renewed my corporate identity certificate and trying to port it to my MAC machine. I can't directly export from my windows machine so attempting to use my activekey instead. I was following instructions that said I needed to install Smart Card Services for the CAC module but the install keeps failing. I'm running 10.8.4 and I think I did something similar in the past as my current certificate is working in Firefox. Maybe that's causing the issue? Does anyone have any ideas? [cid:EC3A5547-09C2-4528-8166-0EFD71D113B7] [cid:CC7078CA-27DC-462E-BE83-C958A5B1EE93]

2 2