- SmartcardServices-Users - lists.macosforge.org

PIV.tokend question: on-card key escrowed support?
by Disiena, Ridley (GRC-VG00)[DB Consulting Group, Inc.] 30 Apr '13

30 Apr '13

Does the OS X Forge provided PIV.tokend support the on-card key history specifications in NIST SP 800-73-3 Part 1? And if so, can OS X Applications [via the PIV Keychain] make use of the Key History -> Retired X.509 Certificate for Key objects Link to info http://csrc.nist.gov/publications/nistpubs/800-73-3/sp800-73-3_PART1_piv-ca… Thanks in advance, Ridley DiSiena NASA ICAM Engineering

2 1

Problems accessing Certificates on ActivKey
by Alvaro 23 Apr '13

23 Apr '13

Hi all, I have installed latest version of the Mountain Lion drivers and when I open the Keychain, all I can see is an empty keystore for the CAC device. There are no certificates listed. I had a similar problem on ubuntu last year when my employer updated my certificates and I solved it by installing a patched version of coolkey with support for multislot devices ( https://bugzilla.redhat.com/show_bug.cgi?id=826286) Do you know if the CAC tokend support this kind of configuration? Any idea what can be the problem and how to solve it? I have a great new macbook pro that I cannot use for work due to this problem. Thanks, Alvaro

2 5

CAC Reader for OS 10.6.8
by Rick & Tara Webster 08 Apr '13

08 Apr '13

I upgraded from OS 10.5 to 10.6.8 understanding that Snow Leopard had the CAC reader capability but didn't meet with success. I'm now trying to find the drivers I need and keep running into walls. Mac OS Forge, the site that led me to this page, offers help with OS 10.5 and 10.7 but not 10.6. Does anyone know where I can find the services update for 10.6 Snow Leopard? Thanks, Rick

3 4

CAC Login without Internet connection
by Michael Kluskens 04 Mar '13

04 Mar '13

OS X's caching of the CRL list information is too short. Is is possible to change the cache timeout? Background: CAC login using SmartCardServices, edited /etc/authorization, added DoD certificates to System keychain. CAC login requires an active Internet connection in order to check the CRL lists. Problem is that we can't login into our computer when they are not connected to the Internet. If someone takes a laptop to a meeting they can't use their laptop since we rarely have Internet at meetings. Same problem for work at home and on travel. Unless the network connection is known and set up before they leave the office they can't use their computer. If the computer returns to work with the "wrong" network configuration selected they will not be able to log in. If I CAC login to my computer, remove it from the Internet for "too long" I can't unlock the screen saver and the machine required a hard power off to recover. Michael

1 0

Possible Stupid question
by John Daly 22 Feb '13

22 Feb '13

Greetings all, I looked on the documentation at macOS Forge, and haven't found a great answer: I have an Open Directory setup and need to configure it so that users can log into their accounts using their smart card. So far, I've not been able to get this to work, and haven't been able to find a good set of instructions for doing so. Shawn's answers indicate that it's possible and perhaps considered such an easy, obvious, task that it doesn't require directions, but I'm one of the RTFM kinda guys, so I'd like to find the manual so I can read it. Thank you, John

2 1

Dowloading Error
by Carlsen, David D MAJ RET 22 Feb '13

22 Feb '13

Hello List, I tried downloading the Mt Lion smart card code, but keep getting an error saying the file is damaged and needs to be put in the trash (see attached). I thought maybe not having the certs was the problem, but I get the same error after installing them. - OSX Version 10.8.2 - 2.8 Ghz Intel Core 2 Duo MacBook Pro - 8GB RAM Any help will be appreciated. Regards, Dave -- David D. Carlsen, Ph.D. Contractor, Kratos Government Solutions TCM Networks & Services Fort Gordon, GA 30905 david.d.carlsen.ctr(a)mail.mil dave.carlsen(a)us.army.mil 706-231-9784 (Mobile)

2 2

CAC login on OS X 10.7 & 10.8
by Michael Kluskens 21 Feb '13

21 Feb '13

1) I cleaned installed and updated OS X Lion on a unused disk. 2) I installed the SmartCardServices Installer v2.0.b2 for Lion 3) I used sc_auth hash and selected the first hash for use with sc_auth accept -u useraccount -h ... 4) I confirmed the hash entry with dscl . -read /Users/useraccount 5) I added builtin:smartcard-sniffer,privileged to both the system.login.console and authenticate sections of /etc/authorization Confirmed that my Gemalto CAC card works with OS X Mail and Safari, log out and insert card, no effect, reboot, insert card, no effect. What step did I miss? I was never inserting a reader / card on a vanilla install of OS X Lion. Are there newer instructions on the precise location for the smartcard-sniffer entries? What log files do I look at, secure.log seems related but I can't tell if anything in there was an error. > There are three methods for associating a Smart Card to a given user account in either the local or remote DS. > PubKey Hash - Default method used by OS X and requires sc_auth > Attribute Matching - requires /etc/cacloginconfig.plist > PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC > All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. > Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. > Project Site: > http://smartcardservices.macosforge.org/ > > Installers: > http://smartcardservices.macosforge.org/trac/wiki/installers > > There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. >

1 2

Help with token detection and certificates retrieving
by Bernardo Höhl 20 Feb '13

20 Feb '13

Dear friends from list, I am a new bye in smartcards. I have written an app that invoices under the brazilian invoicing project. At this moment I can only use certificates as files, I dream my app could one day use smart cards and tokens. I am trying to write a small concept project to help me detect when a token is inserted and retrieve the token contents (certificates) for signing XML files and SOAP messages. If you could please take a look at the attached project and help me achieve its funcionality, I will be very thankfull. Thank you for reading. Bernardo Höhl Rio de Janeiro - Brazil =============================== PN: I am not a rich man, but I can afford a small payment for helping me, or send you a nice present from Brazil.

1 0

Problem with Smart Card Services Update 2.0b2-ML-signed
by Boško Ivanišević 14 Feb '13

14 Feb '13

I had problems with Gemplus GemPC smart card reader and I tried to solve it by installing Smart Card Services Update 2.0b2-ML-signed.pkg on OS X 10.8.2. After installation my lock screen dialog box has changed from small one to the standard, large. In addition when ssh key is loaded it is sometimes impossible to type in password (characters are typed in the terminal windows). I would like to uninstall this package. Can somebody help me with this? I cannot find a way to uninstall Smart Card Services. -- Bosko

1 0

Re: [SmartcardServices-Users] [Fed-Talk] EAP-TLS Authentication with CAC on iPad or iPhone
by Shawn Geddis 30 Jan '13

30 Jan '13

Henry, I do agree this belongs on a developer list and have included the SmartCardServices-Users and Tokend-Dev lists here. I will quickly try to address your items and this can continue on the other lists (other than Fed-Talk). On Jan 30, 2013, at 1:42 PM, "Henry B. Hotz" <hotz(a)jpl.nasa.gov> wrote: > On Jan 24, 2013, at 8:51 AM, Shawn Geddis <geddis(a)apple.com> wrote: >> OSX's Smart Card Services are backed by CDSA, which everyone should know was deprecated with the release of OS X Lion v10.7. On OS X, all of the architectural components are still there except the Tokend modules installer needs to be downloaded from our SmartCardServices Project @ MacOSForge.org as well as the need to add the authentication mechanism line back into /etc/authorization. Commercial products are also available to augment or replace what continues to be available from MacOSForge.org. > > Maybe this question belongs on a development list, but I'm not clear about what this means. From an architectural/development point of view, how much of the infrastructure has gone away? As of OS X 10.8.2, even though CDSA & Tokend were Deprecated, Nothing has "gone away". After installing the Tokend modules from MacOSForge.org and modifying your /etc/authorization file accordingly, you have everything that was there before. Architecturally, everything is there! Developers providing Tokend support can still rely on the architecture as it still exits today. Other commercial developers have chosen to augment their products with components that replace what is built-in to OS X (ie. Tokend modules). > Without tokend's, are keychains still supported? "Keychains" are an abstraction of a Key Store. Smart Cards are still available as keychains because of the Tokend abstraction. If you take the Tokend out of the equation or do not have a Tokend installed corresponding to your desired Smart Card then No, the smart card would not appear as a keychain -- that has been the case since day 1. > (Do smart cards still look like funny-named keychains?) Funny Named ? The name depends on the Smart Card in use and what logic the Tokend developer chooses to use for Keychain naming. From Apple, we provided a name that began with the card type (ie. "CAC-", "CACNG-", "PIV-", "BELPIC-") and then the unique card identification. > Can you still daisy-chain keychain entries so one keychain entry can say to use another keychain for some specific thing? You are referring to the use of the CLI command "systemkeychain" Usage: systemkeychain -C [passphrase] # (re)create system root keychain systemkeychain [-k destination-keychain] -s source-keychain ... systemkeychain -T token-protected-keychain-name man page... SYSTEMKEYCHAIN(8) BSD System Manager's Manual SYSTEMKEYCHAIN(8) NAME systemkeychain -- creates system keychains and allows keychains to unlock keychains SYNOPSIS systemkeychain [-fv] [-k filename] [-C] [password] systemkeychain [-fvc] [-k filename] [-s] [file ...] systemkeychain [-v] [-k filename] [-t] DESCRIPTION The systemkeychain can be used to create a system keychain, make it pos- sible for a keychain to unlock another keychain, or test unlocking a key- chain. .... > There were thousands of pages of documentation for CDSA. While I was never up for reading them, it looked like it should be possible to associate Apple functionality with CDSA if you looked. The Apple doc's always seemed disjoint, and sparse on details. Without CDSA I'm left feeling like I can't find enough information to actually understand Apple's functionality. If you are only know trying to understand Apple's implementation of CDSA (which by the way is a specification managed by the OpenGroup), I would say it is too late. it was deprecated in OS X Lion and there is no guarantee it will exist in a future version of OS X. OS X has provided the "Keychain APIs" for the 99+% of developers that just need to deal with the objects on the cards. Only middleware developers had to deal with CDSA directly. > Of course, maybe the real answer will depend on what happens in the validation process. *sigh* Validation of what ? >>> Given ubiquitous PKI support, the card should, IMO, be just an OS device driver issue, not an application issue. >> >> I would agree that it would be very nice to rely on integrated services for use of various hardware tokens. I will strongly disagree that it is simply a device driver issue -- tight integration like smart cards have on OS X does not come through the OS vendor simply dropping in a device driver - it is much more than that. > > Yeah, "device driver" is oversimplified. I meant the whole PIV/CCID/USB/(pcscd/tokend?)/keychain(or pkcs11) support stack. Given the OS has a ubiquitous API for interfacing with PKI credentials, the card should be supported by that API and not require every single application to write special card support code. CCID, USB, PCSCD, Tokend... are all part of the "Smart Card Services"... As noted above...OS X has provided the "Keychain APIs" for the 99+% of developers that just need to deal with the objects on the cards. Only middleware developers had to deal with CDSA directly. - Shawn ________________________________________ Shawn Geddis Security Consulting Engineer Apple Enterprise Division

1 0