September 2015 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

OS X 10.11 and SmartCard Services
by Lamb, John (NIH/NCI) [C] 30 Sep '15

30 Sep '15

All, I am supporting a large install base of users (roughly 1000 users for 2000 computers) with: Identiv SCR3500 A Contact Reader Product ID: 0x5814 Vendor ID: 0x04e6 (Shuttle Technology) Version: 2.02 Which are nearly physically identical to SMC Microsystems SCx35xx v2.0 USB SC Reader Product ID: 0x5410 Vendor ID: 0x04e6 (Shuttle Technology) Version: 3.04 In OS X 10.7 -> OS X 10.10 the SCx35xx automatically works, the SCR3500 needs a “driver” ( http://support.identive-group.com/show_faq.php?f_kz=1065&lang=EN##) which adds a new bundle at /usr/libexec/SmartCardServices/Drivers/smccid.bundle [ “by works” I mean in /var/logsystem.log the OS will log the insertion/removal of a reader. Be assured that I am not troubleshooting card/user/certificate issues here. ] Alternatively, you can use the provided script in that FAQ article to modify the existing ifs-ccid.bundle. Therefore, as far as I understand it these are functionally identical, and the issue is properly identifying the card reader to the OS so drivers that already exist can do their job In order to be able to support upgrades to OS X 10.11, I will need to provide support for these card readers. Due to /usr/libexec being off limits to SIP, i see the following options: 1. When I create a new OS X 10.11 image, temporarily disable SIP during creation to place the drivers. Should I have a later “driver” conflict I will need to disable SIP to remove the smccid.bundle, which presents challenges at this scale. 2. Ask the developers of smartcardservices if a new release will support these card readers (and I have delayed close as I can to the release of OS X 10.11 so that I can say its “Sept 30th somewhere.” 3. Ask the developers if there is a better way to reference a non-SIP location for a driver (for instance, with 10.11 lacking pcscd (or at the very least, which pcscd coming up with nothing), is /etc/reader.conf still honored? In which case I simply need to identify the right CHANNELID and i can place the driver at /usr/local/pcsc/drivers/smccid.bundle) or a writeable location somewhere in /Library/ that smart card services already looks for drivers 4. File a bug report to Apple, asking for /usr/libexec/smartcardservices/drivers to be exempted from SIP (I am aware that this strays into unsupported territory and I will be correspondingly courteous and understanding.) I will be prepared for 1, and this email is asking politely for 2 or 3. I’ll pursue 4 if warranted. Thank you very much. John Lamb (Contractor) SRA International National Cancer Institute Center for Biomedical Informatics and Information Technology 9609 Medical Center Drive Rockville, MD 20850 lambje2(a)mail.nih.gov<http://lambje2@mail.nih.gov>

3 4

mixed success with two smart cards and SCR 335
by Kostantinos Koukopoulos 17 Sep '15

17 Sep '15

Hi all, I'm trying to use two different smartcards and having mixed success, using Mac OS X Yosemite. My reader is a SCM SCR 335 USB reader and the two cards I have tried are the OpenPGP card by g10 [1] and the Estonian ID card [2]. So far I have been able to use gnupg to decrypt a file using a key on the openpgp card, and I have also managed to configure Firefox and Chrome to see the certificate on the Estonian ID card. So, already this is considerable success and I thank you for the software you provide to make it possible. However not everything is going smoothly. For one, while I have the openpgp card in the reader I see these messages in the console: 9/17/15 10:46:58.268 AM com.apple.SecurityServer[80]: token in reader SCM Microsystems Inc. SCR 335 cannot be used (error 229) 9/17/15 10:46:58.537 AM com.apple.SecurityServer[80]: reader SCM Microsystems Inc. SCR 335: state changed 32 -> 290 9/17/15 10:47:00.947 AM com.apple.SecurityServer[80]: token in reader SCM Microsystems Inc. SCR 335 cannot be used (error 229) 9/17/15 10:47:00.949 AM com.apple.SecurityServer[80]: reader SCM Microsystems Inc. SCR 335: state changed 288 -> 34 9/17/15 10:47:01.197 AM com.apple.xpc.launchd[1]: (com.apple.ctkpcscd[11360]) Service exited due to signal: Killed: 9 These messages repeat endlessly until I remove the card. This does not happen with the estonian id, only with the openpgp card. Any idea what might be causing this message? Second, I tried to configure Mac OS X to allow logging in with the Estonian ID smartcard. I used the "sc_auth accept" command. I didn't see any error, however I was unable to test it because after a restart I realized that my smartcard's PIN was blocked. I don't have the PUK with me at the moment, but I will retry when I do. Does anybody have any tips as to what I should do? I'm afraid to try with my openpgp card in case the same thing happens. As for the software installed: I have installed Smartcard Services (v2.0.2) *and* I have installed the Estonian ID software (which I think installs Safesign, i.e. /usr/local/lib/libaetpkss.dylib). The first I did while trying to use my openpgp card, and the second while trying to use my estonian digital id card. Is there a possibility that they are somehow conflicting? Thank you, Konstantinos 1. http://www.g10code.com/p-card.html 2. http://id.ee/index.php?id=30470 -- |/ |/ Konstantinos <koukopoulos(a)gmail.com> |\ |\ Koukopoulos <http://kouk.surukle.me> VSRE messages are welcome*, Thanks! * for more information see: http://vsre.info <http://vsre.info/>

1 0