August 2015 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

Pkinit working on MacOSX 10.9.5 or 10.10?
by Glenn Machin 31 Aug '15

31 Aug '15

The only way I can see a Kerberos AS_REQ using PKINIT is using the command line "kinit -C KEYCHAIN:". Has anyone got PKINIT working via OpenDirectory during login or via pam modules (pam_opendirectory or pam_krb5)? Shame I don't see Apple publishing documents describing how to enable pkinit given federal government requirements for use of smartcards. Seems like its the users helping users, while Apple keeps quiet. Appreciate any help. Glenn

3 6

Re: [SmartcardServices-Users] [EXTERNAL] Re: Pkinit working on MacOSX 10.9.5 or 10.10?
by Glenn Machin 31 Aug '15

31 Aug '15

Shame Apple won't enable the use of : pkinit_identities = PKCS11:Path_of_pkcs11_lib for their Heimdahl Kerberos implementation. If they did the then the pam_krb5 module could be added to /etc/pam.d/sudo. I believe Heimdahl Kerberos supports it. I know the MIT Kerberos does. Thanks for the information. Glenn On 8/31/15 6:53 AM, Carib Mendez wrote: > . >> We are also going to get the non-express version of Centrify to see if that enables pkinit with PIV for login and screenlock, I will let this email list know what I find. >> > We use the full centrify in our environment. I can attest to it's ability for full CAC login, PKINIT and screenlock. It also include a pkcs11 module for apps that don't use regular system keychain calls (Firefox primarily). THe only thing it does not include is the ability to use your CAC at the command line with sudo. I believe thursby has a special sudo that will authenticate with the CAC, but centrify unfortunately does not. Their solution is to add admin groups to the sudoers file so they don't have to enter a password for sudo. > > >> Thanks for the response, >> >> >> >> Glenn >> >> >> >> >> On 8/31/15 2:04 AM, Yoann Gini wrote: >>>> Le 29 août 2015 à 23:30, Glenn Machin <gmachin(a)sandia.gov> a écrit : >>>> >>>> The only way I can see a Kerberos AS_REQ using PKINIT is using the command line "kinit -C KEYCHAIN: ». >>> Same behaviors here. I’m not able to use standard system in PKINIT system. >>> >>>> Has anyone got PKINIT working via OpenDirectory during login or via pam modules (pam_opendirectory or pam_krb5)? >>>> >>>> Shame I don't see Apple publishing documents describing how to enable pkinit given federal government requirements for use of smartcards. >>>> Seems like its the users helping users, while Apple keeps quiet. >>> The only advice I can tell is to use Centrify Express. It’s free, it works, and it will be quick for you. >>> >>> Best regards, >>> Yoann Gini >>> >> _______________________________________________ >> SmartcardServices-Users mailing list >> SmartcardServices-Users(a)lists.macosforge.org >> https://lists.macosforge.org/mailman/listinfo/smartcardservices-users

1 0

Yosemite SmartCard Services and Local and or Open Directory Accounts
by Schwartz, Jared 30 Aug '15

30 Aug '15

Hello All, I have made great progress with the Smart Card services tool and our PIV cards. I was able to login to web portals with no issues but I have hit a roadblock and was hoping you could help. We have our machines connected to an open directory, and would like to login to the account via PIV cards. As a test I used sudo sc_auth accept -u administrator -k "PIV" and or $ sudo sc_auth accept -u Alice -h HASH to bind the certificates hash to the local administrator account. I verified the hash is set under the local administrator account and then logged out but I never get the "switchover" from password login to PIN on Mac OS 10.10.5. I also tried on a machine that is not connected to the open directory with the same result. After we get past the issue of it not being able login with the PIN, any idea how we setup the hash attribute for our users in open directory? Thanks in advance, Jared

2 1

Re: [SmartcardServices-Users] PKCS11 library availability
by Disiena, Ridley (MSFC-IS60)[EAST] 25 Aug '15

25 Aug '15

To answer non-athoritatively, it has never shipped with the Smart Card Services installer from Mac OS Forge. It was included in 10.6 and 10.7 and shipped in the OS as part of the Golden Master. The source may be found here: http://smartcardservices.macosforge.org/trac/browser/trunk/TokendPKCS11 It is unclear why they stopped providing it, it does work for auth/signing and decryption, even on the latest versions of the operating system. To use it. one could track down the older binary or build from source as needed. -Ridley From: <smartcardservices-users-bounces(a)lists.macosforge.org<mailto:smartcardservices-users-bounces@lists.macosforge.org>> on behalf of "Alekseyev, Vsevolod (NIH/NIAID) [E]" <VAlekseyev(a)niaid.nih.gov<mailto:VAlekseyev@niaid.nih.gov>> Date: Thursday, August 20, 2015 at 4:05 PM To: "SmartcardServices-Users(a)lists.macosforge.org<mailto:SmartcardServices-Users@lists.macosforge.org>" <SmartcardServices-Users(a)lists.macosforge.org<mailto:SmartcardServices-Users@lists.macosforge.org>> Cc: "Cobbs, Ronald (NIH/NIAID) [C]" <ronald.cobbs(a)nih.gov<mailto:ronald.cobbs@nih.gov>> Subject: [SmartcardServices-Users] PKCS11 library availability Hi everyone, Is the PKCS11 over TokenD library shipped with Smart Card Services for MacOS 10.9-10.10, please? The wiki page does mention it under http://smartcardservices.macosforge.org/trac/wiki/tokend and under http://smartcardservices.macosforge.org/trac/wiki/scs , but I couldn’t find it neither on the system (after installing from http://smartcardservices.macosforge.org/trac/wiki/installers ), nor in the package itself. Regards, Seva Alekseyev

2 3

PKCS11 library availability
by Alekseyev, Vsevolod (NIH/NIAID) [E] 20 Aug '15

20 Aug '15

Hi everyone, Is the PKCS11 over TokenD library shipped with Smart Card Services for MacOS 10.9-10.10, please? The wiki page does mention it under http://smartcardservices.macosforge.org/trac/wiki/tokend and under http://smartcardservices.macosforge.org/trac/wiki/scs , but I couldn't find it neither on the system (after installing from http://smartcardservices.macosforge.org/trac/wiki/installers ), nor in the package itself. Regards, Seva Alekseyev

1 0

keep pcscd from exiting
by liuddd 19 Aug '15

19 Aug '15

Hello！ I found after I plug out my ccid device, the pcscd process will exit automatically, but my application can't get notification of its exit. And after pcscd exit, some PCSC API will cause segment fault error. So how can I be notified of pcscd's exit or how can I keep pcscd from exiting? Thank you!

2 1

Smart Card reader not being "seen" by Navigator
by PR Bueno 04 Aug '15

04 Aug '15

Hello All, I’m facing problems to use my smart card reader and, therefore, my smart card with my Mac. I’ve checked everything I could and Apple helped me in all possible ways they could but I cannot download my certificate into my smart card. It seems the navigator (Firefox and Safari) are unable to “see” my device. The “pscstest” confirms the device is recognized by my Mac. The problem is indeed on communicating it with the site I am. Can anybody help me, please? Than you! Olá a todos, Venho enfrentando problemas para usar meu leitor de smart card. Verifiquei tudo o que pude com a Apple e não conseguimos baixar o certificado no meu smart card. Aparentemente o problema está em fazer o navegador enxergar meu leitor. Alguém poderia me auxiliar, por favor? Obrigado! Paulo Roberto Bueno

2 1