- SmartcardServices-Users - lists.macosforge.org

SmartCardServices Installer Posted for OS X Yosemite v10.10
by Shawn A. Geddis 31 Oct '14

31 Oct '14

SmartCard Services Community, Installer posted for OS X Yosemite v10.10. This SmartCardServices Installer provides the Tokend modules and cacloginconfig.plist for installation on your OS X Yosemite systems. Note that the installer and Tokend modules are not digitally signed again yet, but will be in the future. To ensure you have the original installer posted here and not one that has been modified, please verify the SHA-1 hash of the .zip you download against the hash posted for the corresponding installer from the installers download page: http://smartcardservices.macosforge.org/trac/wiki/installers/ <http://smartcardservices.macosforge.org/trac/wiki/installers/> - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Security and Certifications Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0

pkcs11 libs & macOS
by fredzy padzy 21 Oct '14

21 Oct '14

Hi Does someone know what is the equivalent of the windows pkcs11 library (aetpkss1.dll) on macOS ? I used this library in order for my Burp tool to access a smartCard through my omniKey reader. I've tried several libs : ls -al /usr/local/lib/libaet* -rw-rw-r-- 1 root wheel 52K Oct 1 2012 /usr/local/lib/libaetdlss.3.0.2508.dylib lrwxr-xr-x 1 505 admin 25B Oct 13 10:36 */usr/local/lib/libaetdlss.3.0.dylib*@ -> libaetdlss.3.0.2508.dylib lrwxr-xr-x 1 505 admin 20B Oct 13 10:36 */usr/local/lib/libaetdlss.3.dylib*@ -> libaetdlss.3.0.dylib lrwxr-xr-x 1 505 admin 18B Oct 13 10:36 */usr/local/lib/libaetdlss.dylib*@ -> libaetdlss.3.dylib -rw-rw-r-- 1 root wheel 743K Oct 1 2012 /usr/local/lib/libaetjcss.3.0.2509.dylib lrwxr-xr-x 1 505 admin 25B Oct 13 10:36 */usr/local/lib/libaetjcss.3.0.dylib*@ -> libaetjcss.3.0.2509.dylib lrwxr-xr-x 1 505 admin 20B Oct 13 10:36 */usr/local/lib/libaetjcss.3.dylib*@ -> libaetjcss.3.0.dylib lrwxr-xr-x 1 505 admin 18B Oct 13 10:36 */usr/local/lib/libaetjcss.dylib*@ -> libaetjcss.3.dylib -rw-rw-r-- 1 root wheel 7.0M Oct 1 2012 /usr/local/lib/libaetpkss.3.0.2528.dylib lrwxr-xr-x 1 505 admin 25B Oct 13 10:36 */usr/local/lib/libaetpkss.3.0.dylib*@ -> libaetpkss.3.0.2528.dylib lrwxr-xr-x 1 505 admin 20B Oct 13 10:36 */usr/local/lib/libaetpkss.3.dylib*@ -> libaetpkss.3.0.dylib lrwxr-xr-x 1 505 admin 18B Oct 13 10:36 */usr/local/lib/libaetpkss.dylib*@ -> libaetpkss.3.dylib But none seem to work Any idea ? regards FP

1 0

Re: [SmartcardServices-Users] OSX Mavericks - cant see my certificate
by Anand 07 Aug '14

07 Aug '14

> > After installing smartcardservices, I am able to see the "CAC blah blah > blah" in my Keychain, but I cant see anything inside it.... I dont see my > Class A certificate in it... that I used to see in OSX Lion... Any pointers? >

1 0

Java and CAC
by Peter Walsh 30 Jul '14

30 Jul '14

====================================== REPOSTING No response the first time so trying one more time ====================================== The new SmartCardsService 2.0 is great. Works like a champ for us in a DoD environment. We are tying to get back to a point where we can use our CACs with Java, with a specific goal of using jsvn with Forge.mil. For a while were able to do a jsvn and CoolKeys combo. We would have to add the PKCS11 security provider to Java and it would point to the /usr/libexec/SmartCardServices/pkcs11/tokendPKCS11.so. Then there was a brief window where the Apple supplied Java eliminated the need for CoolKeys. That was short lived as I think it was lost in the shift to 64-bit Java. In Mavericks with SmartCardServices 2.0, is there a PKCS11 provider that we can point to? The SCardServices and SCardTokend page refers to a tokendPKCS11.so shim but we don’t see it installed anywhere. Are we missing something? Or do we still need a third party piece? FWIW, in our testing OpenSC is only working for some tasks (e.g. keytool) and only with debug enabled; CoolKeys isn’t readily available, is 32 bit only and hasn’t been updated in a while. Thanks. Peter Walsh Jackpine Technologies, Inc. peter.walsh(a)jackpinetech.com c. 617/816-6001

3 2

WWDC feedback
by Yoann Gini 25 Jun '14

25 Jun '14

Hi folks, Some of you has ask me for a feedback about what I’ve seen at the WWDC this year who can be interesting for Enterprise. Since the NDA is way more permissive this year, I think I can directly post my feedback on the list. The list isn’t ordered at all. — With OS X Yosemite, MDM will be able to install application to managed computers. Standalone app and flat package will be supported. — With iOS 8 and OS X Mavericks, books distribution via MDM will be supported. — With iOS 8, MDM will be able to rename iOS devices. — With iOS 8, MDM will be able to reset pre existing password restriction. — With iOS 8, MDM will be able to configure S/MIME on a per e-mail account basis. — SSO on iOS 8 will be extended to support certificate based authentication (PKINIT). — With iOS 8 on supervised mode, MDM will be able to block erase features. — With iOS 8, all profiles pushed by a MDM will be presented as one item only and in a specific and explicit settings section (no more the « Profiles » one). — With iOS 8, MDM will be able to declare managed domain. It’s just a nice feature who will tell iOS to display non-managed domain in red (for example if the user send an e-mail to an external account, it will appear in red). — OS X Yosemite now support IKEv2 based VPN and the always on settings. And an interesting fact, we got a lot of demo of the third part app managed preferences from MDM. That’s funny because Apple with it’s own Profile Manager don’t support it at this time. We have to rely on third part one if we wan’t to use this feature. That’s all Enterprise things I’ve noticed during the conference. Tell me if you have any questions. Best regards, Yoann

1 0

OT: WWDC
by Yoann Gini 03 Jun '14

03 Jun '14

Hi folks, A slightly off-topic message. Who’s going to the WWDC this year? I will be in San Francisco for the conference from Friday 30 to Monday 9. If some of you are available it could be nice to drink a beer. Yoann.

3 3

Smart Card Log On to Active Directory
by Sallah, Kebba [USA] 29 Apr '14

29 Apr '14

Does anyone have any documented guidance for setting up a mac to do smart card logon to and Active Directory domain without middleware ? Kebba Sallah PKE Engineering Support

2 2

SIPR Token on Mac
by Sallah, Kebba [USA] 29 Apr '14

29 Apr '14

We are attempting to use the DoD Siprnet Token on Mac OS X 10.7.5 and 10.8 but are running into some issues. The token is a Safenet SC650 with a coolkey applet loaded on it and we are using Omnikey 3121 and SCM SCR3310 card readers. Since there is a coolkey applet on the card we believe we need to install coolkey to be able to read the applet. Trying to compile coolkey from source on the OS X was not working for us so we got a copy of the Red Hat ESC software for Mac, which includes coolkey, and installed it. We also have installed the latest Smart Card Services package. Now when we insert the Siprnet Token into the reader the OS X system shows some information about the token but then it reports coolkey crashed. If we attempt to look at the token in Keychain Access we see a token labeled "JPKI-card #<N>", where <N> is a number that sequentially increases every time we insert the token. So we were wondering if anyone had any thoughts on what might be going on or any ideas on how to get this working? Kebba Sallah PKE Engineering Support

2 1

Re: [SmartcardServices-Users] SmartcardServices-Users Digest, Vol 51, Issue 1
by Tina Kohler 22 Apr '14

22 Apr '14

Installing the driver solved my problem. Thank you so much! Tina Kohler dr00kohler(a)yahoo.com On Monday, April 21, 2014 2:59 PM, "smartcardservices-users-request(a)lists.macosforge.org" <smartcardservices-users-request(a)lists.macosforge.org> wrote: Send SmartcardServices-Users mailing list submissions to smartcardservices-users(a)lists.macosforge.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.macosforge.org/mailman/listinfo/smartcardservices-users or, via email, send a message with subject or body 'help' to smartcardservices-users-request(a)lists.macosforge.org You can reach the person managing the list at smartcardservices-users-owner(a)lists.macosforge.org When replying, please edit your Subject line so it is more specific than "Re: Contents of SmartcardServices-Users digest..." Today's Topics: 1. What do I do next? (Tina Kohler) 2. Re: What do I do next? (Jim Thomas) 3. Re: What do I do next? (David Mueller) ---------------------------------------------------------------------- Message: 1 Date: Mon, 21 Apr 2014 09:46:55 -0700 (PDT) From: Tina Kohler <dr00kohler(a)yahoo.com> To: "smartcardservices-users(a)lists.macosforge.org" <smartcardservices-users(a)lists.macosforge.org> Subject: [SmartcardServices-Users] What do I do next? Message-ID: <1398098815.54635.YahooMailNeo(a)web121004.mail.ne1.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" I have a MacBook Pro running OSX 10.9.2. I have a Stanley Global Technologies CAC reader. My MacBook sees the CAC reader. The reader works properly on an older Mac running OS X 10.7.5 and different middleware (that's not available for OSX 10.9.2), so I'm sure the hardware is working properly. I downloaded and installed?SmartCardServices2.0.1-OSX10.9.zip from http://smartcardservices.macosforge.org/trac/wiki/installers ? I do not see the certs from my CAC in the keychain when I insert my CAC in the CAC reader. It seems there's something else I need to do. I perused your web pages, but I see no instructions for next steps, other than to send a message to this list. What else do I need to do? Thanks, Tina? Tina Kohler dr00kohler(a)yahoo.com

1 0

What do I do next?
by Tina Kohler 21 Apr '14

21 Apr '14

I have a MacBook Pro running OSX 10.9.2. I have a Stanley Global Technologies CAC reader. My MacBook sees the CAC reader. The reader works properly on an older Mac running OS X 10.7.5 and different middleware (that's not available for OSX 10.9.2), so I'm sure the hardware is working properly. I downloaded and installed SmartCardServices2.0.1-OSX10.9.zip from http://smartcardservices.macosforge.org/trac/wiki/installers I do not see the certs from my CAC in the keychain when I insert my CAC in the CAC reader. It seems there's something else I need to do. I perused your web pages, but I see no instructions for next steps, other than to send a message to this list. What else do I need to do? Thanks, Tina Tina Kohler dr00kohler(a)yahoo.com

3 2