March 2016 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

Unable to use Card Reader on Mac 10.11.3
by Eliya Voldman 31 Mar '16

31 Mar '16

I've got a Card Reader SCR33xx v2.0 USB SC Reader. I followed instruction from http://smartcardservices.macosforge.org/trac/wiki/installers and installed OS X El Capitan v10.11 Smart Card Services v2.1.2 [OSX 10.11] Then according to my company instruction I changed Settings for Certificates to 'Always Trust' When I tried to login to my company web site using Card Reader it failed to recognize the card. I talked to my company customer support and they said that officially they don't support this version but many people had success to use it. Then I tried to re-install and etc but nothing helped and I'm stuck. I can't delete Keychain CAC-000-.... I will attach a few files with my status. Please help ... it looks that I'm stuck Thanks

1 0

Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 29 Mar '16

29 Mar '16

Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, A little more then a year or so ago, starting right after i had to get a new identity Card, i started having trouble using the Tokend that was required to use my identification & pincodes in Safari & Keychain Access. Since my identity Card is from Belgium (Belpic Tokend from MacOSForge.org & Beid Tokend from eid.belgium.be) i have had contact with both these Mailing Lists & Fedict.be with a fix which is workable but not really a solution which is tight. The facts: • The Belgian developers have worked with Apple in the past, this delivered the Belpic Tokend which Apple has outsourced to MacOSForge & is still being updated by MacOSForge. • The Belgian Developers found Apple/MacOSForge to be to slow/unresponsive when they added patches & decided to work on their own, the new tokend is called Beid Tokend. • My old identity card used the 2nd version of encryption, my new one uses the 3th version. This made the Belpic tokend defunct & i had to change to the Belpic Tokend. • For unknown reasons on my Mac when using the Beid tokend i have to connect the reader with ID card at boot time to make sure it is recognized by the tokend & usable in Safari & Keychain. When i don’t do this i have a 1/10 chance it could still work, otherwise i need to reboot my Mac. This problem was not there when used the Belpic Tokend. • Notting is wrong with my reader (ACS ACR38) running with Apple’s own driver or the latest driver from ACS (i can uninstall the ACS driver if needed but this don’t change a thing) because if i use the JAVA application from Fedict or the Firefox plugin the card is accessed & working as supposed to. Only when it should use the tokend it fails as explained. So seeing these facts , i can presume & partly this is confirmed by the Fedict.be, that Apple only has the 1st & 2nd version of encryption while the Fedict also has the 3th & 4th version, The Identity Cards that are now issued use the 3th version & the 4th version will be used in future. Also but unconfirmed, i think Belpic because it is being developed & updated for new OS X versions by MacOSforge has kept full compatibility with OS X versions while Beid because it’s being developed by a 3th party with not enough intrest in OS X & unwillingly to work with MacOSForge is not 100 % bugler anymore & in my case a bug causes the behavior as explained above. To add to the pain, i also see in a recent post in SMC Users that the US CAC card has far more functionality then the the Belgian Identity Card, i suppose this functionality is being delivered by the tokend, the CAC tokend i suppose is being developed in a team effort by the US military & MacOSforge. The functionality i have in my mind here is the login in & switching on & off the screensaver or locking the computer by inserting the CAC card in the Card Reader connected to the Mac. I wonder if al this could be fixed somehow, even if the Fedict.be will not be cooperative ? You have both the Tokend’s & source code from CAC & Belpic & you can download the Beid tokend from above mentioned website, it’s inside an installer .pkg but i’m sure you can extract it without installing or even install it in a test environement. I hope you can use the beid tokend to get the 3th & 4th version of encryption without having the source code of it. But ofcource you could also ast the Fedict for the source or develepment kit & if this doesn’t work out, there is a Linux version which can be downloaded as source. I really hope you are willing to fix these issue’s because the Fedict seems not to. (i have a long contact with their support & in each new version they have asked me to test if the bug still exists but it has never been fixed) Yours sincerely Maccampus Belgian Mac OS X User

2 3

Re: [SmartcardServices-Users] Centrify vs Smart Card Services tokend
by Blumenthal, Uri - 0553 - MITLL 29 Mar '16

29 Mar '16

> I’m curious if anyone has insight into how the Centrify tokend is different > then the one that comes from the smart card services project. From what I can > see, they appear to be identical. I’m wondering if they are just compiling > and re-packaging the same code. I had the same impression. ;) I wonder if somebody would be kind enough to help me build SmartCardServices – I tried and failed miserably. Apparently the project file(s) aren’t enough. I’ve Mac OS X 10.10.5 and 10.11.4, Xcode 7.2.1 and 7.3, and my attempt to build fails because all the frameworks (and their include files) are not found (trying to add them manually did not help).

3 2

Centrify vs Smart Card Services tokend
by Jorgensen, Will A 29 Mar '16

29 Mar '16

I’m curious if anyone has insight into how the Centrify tokend is different then the one that comes from the smart card services project. From what I can see, they appear to be identical. I’m wondering if they are just compiling and re-packaging the same code. __________________________________________________ Will Jorgensen IT Engineer Communications & IT Directorate Pacific Northwest National Laboratory www.pnnl.gov<mailto:Jeff.Evans@pnnl.gov>

3 2

Re: [SmartcardServices-Users] Activate screensaver with token
by Daly, John L CIV NAVAIR, 4G0000D 28 Mar '16

28 Mar '16

Yoann, would defaults write com.apple.screensaver tokenRemovalAction 1 get around the caching issue? I note that my accounts do all show tokenRemovalAction 1, and pulling the CAC from the machine causes the screensaver to activate. It's just when I go to unlock the screensaver, the CAC doesn't work if it's a mobile or local account, only works if it's a network account. Thank you, John > Le 23 mars 2016 ? 19:10, Lance Terada, CTR <lance.terada.ctr(a)mhpcc.hpc.mil> a ?crit : > > Hi Shawn, > > Yes, I already enabled smart cards for login. So I guess I?m having another issue as I?ve set that option but my screensaver still doesn?t turn on after I pull my CAC. The read command returns correct information. > > Is there anything else I can check? Did you restart your computer since you?ve set this setting? Or at least killed the cfprefsd service ? Look at the syslog when you remove the smart card to see if the removal is correctly seen. > >> On Mar 22, 2016, at 6:47 PM, Shawn Geddis <geddis(a)icloud.com <mailto:geddis@icloud.com>> wrote: >> >> sudo /usr/libexec/plistbuddy -c "Add:tokenRemovalAction integer 1" /Users/<username>/Library/Preferences/com.apple.screensaver.plist >> sudo /usr/libexec/plistbuddy -c "Add:askForPassword integer 1" /Users/<username>/Library/Preferences/com.apple.screensaver.plist >> sudo /usr/libexec/plistbuddy -c "Add:askForPasswordDelay integer 0" /Users/<username>/Library/Preferences/com.apple.screensaver.plist >> >> >> You can also READ what the settings are using ?defaults': >> >> $ sudo defaults read /Users/<username>/Library/Preferences/com.apple.screensaver Don?t forget cfprefsd when editing plist files on disk. If you use defaults, cfprefsd is updated, but if you use anything else the caching service isn?t updated and your new settings never used.

3 2

Re: [SmartcardServices-Users] Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 28 Mar '16

28 Mar '16

Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, I have found another link. Instead of looking for information in the source for the linux version which obviously won’t have source for the tokend which is OS X technology, you might have a look at folowing github page. https://github.com/Fedict/eid-mw On this page is an xcode project for the tokend. I think this could be very useful. Yours sincerely Maccampus Belgian Mac OS X User

1 0

Activate screensaver with token
by Lance Terada, CTR 24 Mar '16

24 Mar '16

Hello, Does anyone know how to configure activating the screensaver after pulling your token out of the CAC reader? Thanks, Lance

4 6

Re: [SmartcardServices-Users] [Non-DoD Source] SmartcardServices-Users Digest, Vol 68, Issue 1
by Daly, John L CIV NAVAIR, 4G0000D 23 Mar '16

23 Mar '16

Hi Shawn, I have a long standing bug in the OS where I can't unlock the Security & Privacy Pane if my CAC is inserted in the machine. It asks for the PIN and the graphic shows it unlocking like it's supposed to, but then it immediately locks up again. This makes it impossible to get to the Advanced tab. I do use the command line to set tokenRemovalAction to 1, as you stated below, and it works flawlessly on my network accounts, but on Mobile accounts, despite the setting being correct, it will lock the screen when the token is removed, but when going to unlock it, it wants the password and not the PIN. I even verified this by creating an account and logging in to a client machine without letting it create the home directory on the client machine. Everything worked as it should. CAC removal caused the screen to lock, and the CAC PIN could unlock the screen. Logged out and back in, letting it create the home directory on the client machine, and then the CAC could no longer unlock the screen saver. What happened? Apple has gone from having the best out of the box smart card support in the industry to what is being called the worst on "howto" websites. Thank you, John __________________________________________ Message: 2 Date: Tue, 22 Mar 2016 21:47:02 -0700 From: Shawn Geddis <geddis(a)icloud.com> To: "Lance Terada, CTR" <lance.terada.ctr(a)mhpcc.hpc.mil> Cc: SmartCard Services-Users <smartcardservices-users(a)lists.macosforge.org> Subject: Re: [SmartcardServices-Users] Activate screensaver with token Message-ID: <F20B3017-984D-4DD3-B8C4-024A840ECE5B(a)icloud.com> Content-Type: text/plain; charset="utf-8" > On Mar 22, 2016, at 6:09 PM, Lance Terada, CTR <lance.terada.ctr(a)mhpcc.hpc.mil> wrote: > Hello, > Does anyone know how to configure activating the screensaver after pulling your token out of the CAC reader? Lance, If you already have enabled use of smartcards for login, you can simply click on on the ?Advanced?? tab at the lower right-hand corner. System Preferences -> Security & Privacy -> Advanced? This could be scripted with the following commands (Replace <username> with the actual account name): (This ends up being the easiest syntax for many) sudo /usr/libexec/plistbuddy -c "Add:tokenRemovalAction integer 1" /Users/<username>/Library/Preferences/com.apple.screensaver.plist sudo /usr/libexec/plistbuddy -c "Add:askForPassword integer 1" /Users/<username>/Library/Preferences/com.apple.screensaver.plist sudo /usr/libexec/plistbuddy -c "Add:askForPasswordDelay integer 0" /Users/<username>/Library/Preferences/com.apple.screensaver.plist You can also READ what the settings are using ?defaults': $ sudo defaults read /Users/<username>/Library/Preferences/com.apple.screensaver Which would give you the following: { askForPassword = 1; askForPasswordDelay = 0; tokenRemovalAction = 1; } - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Security and Certifications Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0