January 2016 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 21 Jan '16

21 Jan '16

Hi, Just a quick status report to say that the the Yubico PIV tool now has a set-ccc command (along with the existing set-chuid command) so that Smartcard Services will work with the Yubikey NEO and 4. See https://github.com/Yubico/yubico-piv-tool There is no need to modify tokend. Thanks, David L > It would be nice if SmartCardServices tokend could work with a card that doesn't have a CCC object in it. > > In my experience, NEO (a) does not have CCC, and (b) does not perform SELECT command properly. > > One workaround I found for another tokend to work with NEO correctly was to generate a CCC object and write it to NEO using piv-tool from OpenSC package. > >

1 0

Re: [SmartcardServices-Users] SmartcardServices-Users Digest, Vol 66, Issue 2
by liuddd 20 Jan '16

20 Jan '16

Hi ! I followed the " pcscd debug output on Mac OS X " instructions, but when I plug in my USB reader, there is no other log output. It looks like that only CCID USB device is supported on my MacOSX 10.8 , Is the pcscd version(which is 1.4.0) too low? 在 2016-01-18 16:04:28，"Ludovic Rousseau" <ludovic.rousseau(a)gmail.com> 写道： Hello, 2016-01-18 4:12 GMT+01:00 liuddd <liudy75(a)163.com>: Hello! On my MacOSX10.8 system, I put one USB smart card reader(not of CCID class) driver in /usr/libexec/SmartCardServices/drivers, but the pcscd didn't start after I plug the reader in, any other steps should I take to get my driver running? Read " pcscd debug output on Mac OS X " http://ludovicrousseau.blogspot.com/2011/07/pcscd-debug-output-on-mac-os-x.… Bye -- Dr. Ludovic Rousseau

2 1

Yubico Yubikey
by Jorgensen, Will A 18 Jan '16

18 Jan '16

I was looking for different small form factor smart cards (basically something that could be left in the USB port without fear of it being broken) and I came accross the YubiKey Nano. Has anyone had experience with this company or its products? Also, anyone have suggestions for other small form factor devices such as this? __________________________________________________ Will Jorgensen IT Engineer Finance and Project Management Communications & IT I want to hear your feedback

2 1

Re: [SmartcardServices-Users] SmartcardServices-Users Digest, Vol 66, Issue 2
by liuddd 18 Jan '16

18 Jan '16

Hello! On my MacOSX10.8 system, I put one USB smart card reader(not of CCID class) driver in /usr/libexec/SmartCardServices/drivers, but the pcscd didn't start after I plug the reader in, any other steps should I take to get my driver running? At 2016-01-16 04:00:02, smartcardservices-users-request(a)lists.macosforge.org wrote: >Send SmartcardServices-Users mailing list submissions to > smartcardservices-users(a)lists.macosforge.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.macosforge.org/mailman/listinfo/smartcardservices-users >or, via email, send a message with subject or body 'help' to > smartcardservices-users-request(a)lists.macosforge.org > >You can reach the person managing the list at > smartcardservices-users-owner(a)lists.macosforge.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of SmartcardServices-Users digest..." > > >Today's Topics: > > 1. Re: Will a reader driver other than ifd-ccid.bundle for > MacOX10.9 work (liuddd) > 2. Re: Will a reader driver other than ifd-ccid.bundle for > MacOX10.9 work (Ludovic Rousseau) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Fri, 15 Jan 2016 14:50:11 +0800 (CST) >From: liuddd <liudy75(a)163.com> >To: "Ludovic Rousseau" <ludovic.rousseau(a)gmail.com> >Cc: smartcardservices-users(a)lists.macosforge.org >Subject: Re: [SmartcardServices-Users] Will a reader driver other than > ifd-ccid.bundle for MacOX10.9 work >Message-ID: <71747906.abf2.152440c6d7e.Coremail.liudy75(a)163.com> >Content-Type: text/plain; charset="gbk" > >Hello! > Thank you very much! I have another question, can I write a reader driver for non-CCID smartcard reader for MacOX10.9 or MacOX10.8? > I tried, but doesn't work, Is it possible? > > > > > > >? 2016-01-14 18:18:54?"Ludovic Rousseau" <ludovic.rousseau(a)gmail.com> ??? > >Hello, > > > >2016-01-14 10:15 GMT+01:00 liuddd <liudy75(a)163.com>: > > >hello? > We know that we can write a pcsc reader driver on MacOSX10.10 and higher system. Can I write one for MacOSX10.9 and MacOSX10.8?I write one and put in /usr/local/libexec/SmartCardServices/drivers but it doesn't work. Is it possible to write a customer reader driver ? Thank you > > > > >Put your driver in /usr/libexec/SmartCardServices/drivers/ without the "local" part. > > >Bye > > >-- > > Dr. Ludovic Rousseau >

2 1

Will a reader driver other than ifd-ccid.bundle for MacOX10.9 work
by liuddd 15 Jan '16

15 Jan '16

hello！ We know that we can write a pcsc reader driver on MacOSX10.10 and higher system. Can I write one for MacOSX10.9 and MacOSX10.8，I write one and put in /usr/local/libexec/SmartCardServices/drivers but it doesn't work. Is it possible to write a customer reader driver ? Thank you

2 3