August 2013 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

(no subject)
by Daniel Elmore 02 Sep '13

02 Sep '13

I'm am currently trying to download the middleware for OX 10.8 to use my cac card reader on Safari. I was given this sight through a DOD website. All I can find in the upgrade for the middleware and not the middleware it's self. I would like to know where I can get said middleware. Thanks, Daniel Elmore

3 2

More open directory smart card login fun
by John Daly 30 Aug '13

30 Aug '13

Greetings all, I'm attempting to get smart card logins to work on my 10.6, 10.7, and 10.8 clients attached to a 10.6.8 Server with Open Directory. All users have a network account, and we've been directed to engage smart card logins and deny username/password logins. I can get the local login to work using a combination of smartcardservices from MacOSforge and Thursby's Pkard, but I have not been able to get it to work with a directory account. Yoann Gini has a great set of instructions and a modified sc_auth which I tried. The sc_auth does put the smart card's hash into the Open Directory account's Authentication Authority, but I still can't get the login window to ask for a PIN if the account is on the directory. Any ideas? Clues? Step by step instructions? Thank you, John

3 2

Certificate Authentication Issue
by Peter Walsh 13 Aug '13

13 Aug '13

Apologies in advance for a) long post &/or b) if this is the wrong list for this. We have enabled PKI authentication on a system we developed and our Safari users (especially CAC) are experiencing odd behavior. We are not sure if it is a server, client or card side issue. A) If we set SSLClientVerify to optional in http.conf (creates problems for Safari) In this mode, browsers should prompt a user to present a certificate, if one exists in the browser's realm of places to look for certificates. On the Mac, Safari and Chrome use the Keychain. If the user a) doesn't have a certificate, or b) cancels the browser's request to choose a certificate, and no certificate is provided, the server will continue to serve resources as it normally would. Browsers will generally not ask the user about a cert again for the entire browser session. However, in all browsers other than Safari on the Mac, whenever the server-side SSL session expires, the browser re-presents the certificate that the user provided to the server initially. On Mac Safari, the client will prompt the user to select a certificate each time the SSL session expires even though it should theoretically pass through the already-presented cert. This behavior is seen only under 2 conditions: 1) SSLClientVerify is optional, and, 2) Safari knows about multiple client certificates (for example a CAC, which always contains an identity and email cert). In addittion, even if there is Mac Keychain "Identity Preference," Safari seems to ignore any identity preference that is set, or any knowledge of a cert it already sent in this situation. If the CAC isn't present, Safari will pass the com.apple.idms.appleid.prd.[UUID} cert which will fail as an invalid user id. As a note: Mozilla appears to have struggled with this issue (which seems to have been a conscious design decision) for a long time: https://bugzilla.mozilla.org/show_bug.cgi?id=149673 B) SSLClientVerify require (creates problems for IE 8/9) In this mode, browsers will prompt a user to present a certificate. If there is no cert available to the browser, or the user cancels the request for a certificate, the server will return a 403 (Forbidden) error. Typically, this is configured not for an entire "VirtualHost", but rather only for a given "Location" stanza in Apache's config. However, whenever Apache encounters a change in the SSLClientVerify (i.e., it goes from "none" to "require"), it attempts to do an SSL renegotiation, since it has previously negotiated the SSL connection with one set of parameters and now needs to re-negotiate with a different set of parameters. When we attempt to use this functionality on our "Location" (a URL we access with POST requests) that deals with certificate processing, all browsers prompt for client certificate immediately. Most browsers successfully do the re-negotation (albeit with varying levels of server-side attempts before finally succeeding) within a second. IE 8 and IE 9, however, attempt to do the re-negotation and is never successful, eventually timing out when it reaches the global timeout value set in Apache. If the user immediately re-attempts the connection, it goes thru. In this configuration, Safari users behave like others. Thanks. Peter Walsh Jackpine Technologies, Inc. peter.walsh(a)jackpinetech.com c. 617/816-6001

1 0

Installer for mountian lion 10.8
by Roberto B. Amador 13 Aug '13

13 Aug '13

Sir, the following install package is failing during install. I am getting a certificate expired message at the beginning of the install which leading me to think is failing the entire process. Is there an updated installer with updated certificate available? Even though it says new, it was updated 18 september 2012. Almost a year ago. I hate having to take both my PC and MAC anywhere I go just to keep up with work. Thank you, Roberto **NEW** Smart Card Services Update v2.0.b2-MtLion (Sep 18, 2012) OS Requirement: OS X Mountain Lion v10.8 SHA-1 Hash: 4b012dd7a8f39f68311a6f48aa734c9231ac1e3f This installs the Tokend modules which no longer ship from Apple as part of Mac OS X beginning with OS X Lion (v10.7). Note that this installer will ONLY install onto OS X Mountain Lion v10.8. The Tokend modules installed are: BELPIC, CAC, CACNG, JPKI and PIV. New to this release: • JPKI.Tokend - Build 38522 added to the update to support LASCOM in Japan. • cacloginconfig.plist - Default configuration file as optional install for those using Attribute Matching or PKINIT configurations. • SystemCACertificates.keychain - Automatically added to the Keychain Search List if not already present. The Installer has been digitally signed, but it is possible you may not have the Intermediate CA Certificate on your system for signature validation. If you do not have it, you can pull it down from Apple's Root Certification Authority site with the specific Intermediate CA Certificate found HERE.

1 0

[SOLVED] Re: SuisseID on 10.8
by Stephan Rickauer 12 Aug '13

12 Aug '13

Michael, I did add the entire certificate chain but not to the keychain called System. Now I did as you advised and indeed, it works! Thanks a lot, Stephan Michael Kluskens schrieb: > Stephan, > > I don't see where you added certificates to the System Keychain, that was the problem I had. It's barely documented anywhere, but there are references to needing the entire certificate chain in the System Keychain. So if the login certificate is signed by A, then A needs to be in the System Keychain, etc. > > Michael Kluskens

1 0