April 2016 - SmartcardServices-Users

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

Re: [SmartcardServices-Users] Can MacOSX work with Oberthur ID-One PIV (type A) cards and ID Prime .Net from Gemalto?
by Hoit, Daniel S. 08 Apr '16

08 Apr '16

Uri, I’ve got it on my to do list to look at the OpenSC stuff again. If it does a good job supporting PIV, it might be something we could use. As for why someone would use the .Net cards, I can answer that pretty easily. They work with Microsoft’s Forefront Identity Manager, and are already in use in some places. We haven’t had any luck getting FIM to provision PIV cards. I don’t know that its not possible… but Microsoft has been less than helpful on providing the needed details, and it certainly seems like its simply not supported. We’ve been using the .Net cards for years, they are tied into our identity provisioning workflow, and so with mandates looming, it made sense to take what we already had working and adapt it for the new need. Were we starting from scratch, looking to support smart cards across three platforms, I don’t think we would go down that route. —DH On Apr 8, 2016, at 11:17 AM, Uri Blumenthal <uri(a)mit.edu<mailto:uri@mit.edu>> wrote: I know PIV is served well by OpenSC.tokend. If it would work with .Net cards (and I’ve no clue what those are, or why one would bother, when PIV and OpenPGP tokens are both available and reliable), going OpenSC route could be a good direct solution that doesn’t require contortions to get various .tokend compiled (as you know, I tried to use PKCS11.tokend, and failed). P.S. This email is signed by a PIV token in Gemalto Proxy-DU reader, using OpenSC.tokend. On Apr 8, 2016, at 14:07 , Hoit, Daniel S. <hoit2(a)llnl.gov<mailto:hoit2@llnl.gov>> wrote: Glenn, We are using both at LLNL, although we are looking into replacing the .Net cards since it causes issues switching libraries on the linux boxes. The .Net cards use the PKCS11.tokend module that Ludovic Rousseau wrote, along with a Framework and some libraries to provide the pkcs11 support. Unfortunately, the version that Gemalto is currently providing will only look in /usr/lib/pkcs11, and since that location is restricted on SIP enabled systems, it breaks. Luckily, the source for PKCS11.tokend is on the smartcard services web site, and Ludovic has an updated version there that will look in /usr/local/lib/pkcs11. Hopefully Gemalto updates their installer to use that version in the future, but in the meantime I simply pulled down the newer tokend code, built it, and packaged it with the existing libraries set to be put in SIP compliant locations. They do use different pkcs11 modules, so if thats part of your deployment, you may have issues. I can use the tokendpkcs11.so for generating a key off the .Net cards, but trying to use it with SSH it relays a signing error, and fails. Considering its doing the gemalto PKCS11 -> PKCS11.tokend -> tokendPKCS11.so, its not really surprising that its flakey. Most tools allow you to point to a separate library at the command line though, so you could always have an aliased SSH for the .NET card that uses -I /usr/local/lib/pkcs11/<whichever gemalto pkcs11.so you are using> The biggest issue with using a “civ” card along side the PIV is user mapping. Once we solved that, everything else has been pretty straight forward. I’d be happy to discuss the details of our implementation if you’d like. You know how to get ahold of me. :) —DH On Apr 8, 2016, at 10:32 AM, Machin, Glenn D <GMachin(a)sandia.gov<mailto:GMachin@sandia.gov>> wrote: We have a situation where will have users using a PIV (Oberthur ID-One PIV (type A)) and the ID Prime .Net from Gemalto. We want to make sure MacOSX can support both cards. Out of the box on MacOSX ID Prime .Net from Gemalto does not work and we want to make sure we don’t break the PIV to get the .Net card to work. We have found that on Linux (red hat) only one pkcs11 module will work at a time for either pam_pkcs11 or pam_krb5, and each card needs its own pkcs11 module, therefore only one card can be configured at a time. We don’t want to fall into the same trap with MacOSX. Appreciate any help. Glenn _______________________________________________ SmartcardServices-Users mailing list SmartcardServices-Users(a)lists.macosforge.org<mailto:SmartcardServices-Users@lists.macosforge.org> https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Daniel Hoit hoit2(a)llnl.gov<mailto:hoit2@llnl.gov> 925.424.5256 _______________________________________________ SmartcardServices-Users mailing list SmartcardServices-Users(a)lists.macosforge.org<mailto:SmartcardServices-Users@lists.macosforge.org> https://lists.macosforge.org/mailman/listinfo/smartcardservices-users -- Uri the Great uri(a)mit.edu<mailto:uri@mit.edu> Daniel Hoit hoit2(a)llnl.gov<mailto:hoit2@llnl.gov> 925.424.5256

1 0

Can MacOSX work with Oberthur ID-One PIV (type A) cards and ID Prime .Net from Gemalto?
by Machin, Glenn D 08 Apr '16

08 Apr '16

We have a situation where will have users using a PIV (Oberthur ID-One PIV (type A)) and the ID Prime .Net from Gemalto. We want to make sure MacOSX can support both cards. Out of the box on MacOSX ID Prime .Net from Gemalto does not work and we want to make sure we don't break the PIV to get the .Net card to work. We have found that on Linux (red hat) only one pkcs11 module will work at a time for either pam_pkcs11 or pam_krb5, and each card needs its own pkcs11 module, therefore only one card can be configured at a time. We don't want to fall into the same trap with MacOSX. Appreciate any help. Glenn

2 1

tokendPKCS11.so
by Lance Terada, CTR 06 Apr '16

06 Apr '16

Hello, Doesn’t anyone point me to directions on how to build the tokendPKCS11.so for smartcardservices on El Capitan? It doesn’t seem to come with the pkg. Thanks, Lance

1 0