- SmartcardServices-Users - lists.macosforge.org

OT: Looking for working PK-INIT packet dump for a conference
by Yoann Gini 24 Mar '14

24 Mar '14

Hi folks, I’m looking for a pcap dump of a working PK-INIT config. Like you know I try to make it work out of box, without third part tools, but I still fail at it. Mostly because of my smartcards who aren’t well supported on Windows Servers. So I’m trying to get some demo kit from Gemalto actually. In the mean time I’m working on a talk about packet sniffing for admin and in my demos, I would like to show the difference from a packet point of view between a wokring PK-INIT config and the default one. But, to make a capture from a working config… I need one :-) So, if someone can send me a pcap dump of a SmartCard logon (from OS X if possible, or eventually Windows), that could be really nice. Best regards, Yoann

1 0

CAC only sign on
by Bell, Ian F CTR NAWCAD, 7.2.4 21 Mar '14

21 Mar '14

Folks, I am looking to further my CAC usage on my 10.9.x machines by eliminating the either CAC(pin) or password login and having my machines be CAC (pin) only login. I thought I saw a discussion about this at one time looking through the archives, but I am unable to retrieve that information currently. Thanks, Ian Bell

1 0

Encrypted Apple Mail w/ PIV
by Rowe, Walter 15 Mar '14

15 Mar '14

We have our PIV certs populated in AD. I have the OS X Smartcard Services installed and enabled on an OS X 10.9.2 laptop bound to AD. I can successfully log into OS X with my PIV card. I can create new email messages with click the digital signature button to successful send digitally signed emails. I can’t click the encryption button. It is is grayed out. I read in Apple Mail Help that I need the personal certificate for each recipient in my Keychain to send them encrypted messages. Can Apple Mail not get those certificates from AD? Walter -- Walter Rowe, Hosting Services Enterprise Systems / OISM Email: walter.rowe(a)nist.gov<mailto:walter.rowe@nist.gov> Work: 301-975-2885

4 4

[MacOSForge.org] Servers will be down for scheduled maintenance - TUE 11 MAR 2014 8AM-12PM PST
by Shawn Geddis 10 Mar '14

10 Mar '14

SmartCardServices & SCAP-On-Apple Participants, Scheduled maintenance on ALL Mac OS Forge Servers will be taking place on TUE 11 MAR 2014 8AM-12PM PST. It is scheduled to start at 8AM PST and the activity is expected to take about four hours or more resulting in shutdown until at least 12PM PST. All affected servers will be going through a change in IP address. DNS changes to the domain will be made and its propagation to the Public domains will take approximately 30 Mins to an hour. When maintenance begins, all MacOSForge systems are expected to stop functioning. We very much appreciate your participation and hope the scheduled downtime does not negatively impact your efforts. If you have any questions, comments or otherwise, please drop a line to the projects Admin account: SmartCardServices Admin scs-admin(a)macosforge.org SCAP Admin scap-admin(a)macosforge.org - Shawn _______________________________________________________________________ Shawn Geddis Enterprise Security Consulting Engineer, Apple (geddis(a)apple.com) SCAP-On-Apple Project/Dev Lead: (SCAP-On-Apple.MacOSForge.Org) SmartCardServices Project/Dev Lead: (SmartCardServices.MacOSForge.Org) _______________________________________________________________________

1 0

CAC and Java
by Peter Walsh 27 Feb '14

27 Feb '14

Shawn, The new SmartCardsService 2.0 is great. Works like a champ for us in a DoD environment. Thanks! We are tying to get back to a point where we can use our CACs with Java, with a specific goal of using jsvn with Forge.mil. For a while were able to do a jsvn and CoolKeys combo. We would have to add the PKCS11 security provider to Java and it would point to the /usr/libexec/SmartCardServices/pkcs11/tokendPKCS11.so. Then there was a brief window where the Apple supplied Java eliminated the need for CoolKeys. That was short lived as I think it was lost in the shift to 64-bit Java. In Mavericks with SmartCardServices 2.0, is there a PKCS11 provider that we can point to? The SCardServices and SCardTokend page refers to a tokendPKCS11.so shim but we don’t see it installed anywhere. Are we missing something? Or do we still need a third party piece? FWIW, in our testing OpenSC is only working for some tasks (e.g. keytool) and only with debug enabled; CoolKeys isn’t readily available and hasn’t been updated in a while. Thanks. Peter Walsh Jackpine Technologies, Inc. peter.walsh(a)jackpinetech.com c. 617/816-6001

1 0

Installers Updated to v2.0.1 - Only JPKI.tokend affected
by Shawn Geddis 23 Jan '14

23 Jan '14

http://smartcardservices.macosforge.org/post/installers-updated-to-v201-onl… NOTE to JPKI Users Installers updated to v2.0.1 to include an updated JPKI.tokend due to build configuration errors specific to this Tokend. Previous JPKI.tokend provided in Installer v2.0 will fail operational testing and use, so please replace immediately. If you experience any failure in replacing the previously installed JPKI.tokend, please execute the following command, requiring admin privileges, to remove the currently installed Tokend and re-run the installer: # rm -R /System/Library/Security/tokend/JPKI.tokend - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo] SCS Contact: [scs-cotact(a)macosforge.org] SCS Admin: [scs-admin(a)macosforge.org] _____________________________________________________________________

1 0

use multiple tokend
by Rogers, Ed 17 Jan '14

17 Jan '14

I need to use both a CAC and a company issued smart card (PIV). I’m using OS 10.9 and find that if I have both the CAC.tokend and the PIV.tokend installed, that only the first card used is supported and the next is not recognized. I end up having to remove one of the tokend for the other to work. Is there a tokend that supports both CAC and PIV or some way to allow both to be used such that the correct tokend is selected based on the card inserted? R/ Ed Rogers SWFTS SE&I Technical Director LM Manassas (703) 367-1620

3 4

Digitally signing PDF in Preview
by Ben Dugas 16 Jan '14

16 Jan '14

Shawn, Are there any plans to allow digitally signing PDF documents using a smart card in Preview that you are aware of? Thanks, Ben

2 1

SmartCardServices Installers for OS X v10.6-v10.9 Posted!
by Shawn Geddis 14 Jan '14

14 Jan '14

SmartCardServices Installers v2.0 for OS X v10.6 - v10.9 have been postedSmart Cards Supported • BELPIC • CAC • CACNG* (Gemalto TOPDLGX4 144 & G&D FIPS 201 SCE 3.2 - ONLY at this time) • JPKI* (NEW - First time release) • PIV Installers: http://smartcardservices.macosforge.org/trac/wiki/installers - Shawn _____________________________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo] SCS Contact: [scs-cotact(a)macosforge.org] SCS Admin: [scs-admin(a)macosforge.org] _____________________________________________________________________

1 0

of keychains and CAC
by Daly, John CIV NAVAIR, 4L6200D 09 Dec '13

09 Dec '13

Greetings, my quest to enable CAC for all my users continues. Until I can get PKI-INIT to work with Open Directory, I'm simply adding the user's pubkeyhash to their account, following Yoann Gini's directions. I've noticed that the CAC doesn't unlock the user's login keychain when logging in. Previous posts from Shawn Geddis indicate that the command systemkeychain -T /path/to/keychain will tie the keychain to the CAC. In practice, this doesn't seem to be working. If I use the existing login.keychain, I get the error message: /test2/Library/Keychains/login.keychain: CSSMERR_DL_DATASTORE_ALREADY_EXISTS when I run the command. If I generate a new keychain, I can run the command and it will work, but instead of unlocking the keychain at login, or asking me to unlock it with my CAC PIN, it simply locks up all web-based access until the offending keychain is deleted. Has anyone gotten this to work? I can't find any documentation to read, or previous successes to emulate. Thank you, John

2 1