April 2014 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

Smart Card Log On to Active Directory
by Sallah, Kebba [USA] 29 Apr '14

29 Apr '14

Does anyone have any documented guidance for setting up a mac to do smart card logon to and Active Directory domain without middleware ? Kebba Sallah PKE Engineering Support

2 2

SIPR Token on Mac
by Sallah, Kebba [USA] 29 Apr '14

29 Apr '14

We are attempting to use the DoD Siprnet Token on Mac OS X 10.7.5 and 10.8 but are running into some issues. The token is a Safenet SC650 with a coolkey applet loaded on it and we are using Omnikey 3121 and SCM SCR3310 card readers. Since there is a coolkey applet on the card we believe we need to install coolkey to be able to read the applet. Trying to compile coolkey from source on the OS X was not working for us so we got a copy of the Red Hat ESC software for Mac, which includes coolkey, and installed it. We also have installed the latest Smart Card Services package. Now when we insert the Siprnet Token into the reader the OS X system shows some information about the token but then it reports coolkey crashed. If we attempt to look at the token in Keychain Access we see a token labeled "JPKI-card #<N>", where <N> is a number that sequentially increases every time we insert the token. So we were wondering if anyone had any thoughts on what might be going on or any ideas on how to get this working? Kebba Sallah PKE Engineering Support

2 1

Re: [SmartcardServices-Users] SmartcardServices-Users Digest, Vol 51, Issue 1
by Tina Kohler 22 Apr '14

22 Apr '14

Installing the driver solved my problem. Thank you so much! Tina Kohler dr00kohler(a)yahoo.com On Monday, April 21, 2014 2:59 PM, "smartcardservices-users-request(a)lists.macosforge.org" <smartcardservices-users-request(a)lists.macosforge.org> wrote: Send SmartcardServices-Users mailing list submissions to smartcardservices-users(a)lists.macosforge.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.macosforge.org/mailman/listinfo/smartcardservices-users or, via email, send a message with subject or body 'help' to smartcardservices-users-request(a)lists.macosforge.org You can reach the person managing the list at smartcardservices-users-owner(a)lists.macosforge.org When replying, please edit your Subject line so it is more specific than "Re: Contents of SmartcardServices-Users digest..." Today's Topics: 1. What do I do next? (Tina Kohler) 2. Re: What do I do next? (Jim Thomas) 3. Re: What do I do next? (David Mueller) ---------------------------------------------------------------------- Message: 1 Date: Mon, 21 Apr 2014 09:46:55 -0700 (PDT) From: Tina Kohler <dr00kohler(a)yahoo.com> To: "smartcardservices-users(a)lists.macosforge.org" <smartcardservices-users(a)lists.macosforge.org> Subject: [SmartcardServices-Users] What do I do next? Message-ID: <1398098815.54635.YahooMailNeo(a)web121004.mail.ne1.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" I have a MacBook Pro running OSX 10.9.2. I have a Stanley Global Technologies CAC reader. My MacBook sees the CAC reader. The reader works properly on an older Mac running OS X 10.7.5 and different middleware (that's not available for OSX 10.9.2), so I'm sure the hardware is working properly. I downloaded and installed?SmartCardServices2.0.1-OSX10.9.zip from http://smartcardservices.macosforge.org/trac/wiki/installers ? I do not see the certs from my CAC in the keychain when I insert my CAC in the CAC reader. It seems there's something else I need to do. I perused your web pages, but I see no instructions for next steps, other than to send a message to this list. What else do I need to do? Thanks, Tina? Tina Kohler dr00kohler(a)yahoo.com

1 0

What do I do next?
by Tina Kohler 21 Apr '14

21 Apr '14

I have a MacBook Pro running OSX 10.9.2. I have a Stanley Global Technologies CAC reader. My MacBook sees the CAC reader. The reader works properly on an older Mac running OS X 10.7.5 and different middleware (that's not available for OSX 10.9.2), so I'm sure the hardware is working properly. I downloaded and installed SmartCardServices2.0.1-OSX10.9.zip from http://smartcardservices.macosforge.org/trac/wiki/installers I do not see the certs from my CAC in the keychain when I insert my CAC in the CAC reader. It seems there's something else I need to do. I perused your web pages, but I see no instructions for next steps, other than to send a message to this list. What else do I need to do? Thanks, Tina Tina Kohler dr00kohler(a)yahoo.com

3 2