- SmartcardServices-Users - lists.macosforge.org

Re: [SmartcardServices-Users] [Fed-Talk] Updated smartcard installer?
by Shawn Geddis 28 Sep '12

28 Sep '12

Ridley, Responses to questions / statements in your messages... > Interesting that they are still suggesting attribute matchine, is that not worse than using a password? Apparently there is a misunderstanding. I believe (correct me if I am wrong) in your question above you are referring to the inclusion of a default "cacloginconfig.plist" for those who want/need to use it. Note the end of the sentence when we describe what the file is... > • cacloginconfig.plist - Default configuration file as optional install for those using Attribute Matching or PKINIT configurations. For those that may not be aware, built-in OS X PKINIT-based Smart Card Login *also* relies on the existence and mapping defined in the cacloginconfig.plist file. This allows an organization to use a typical "NT Principal Name" (in cert) ==> "userPrincipalName" in the DS or provide them the flexibility to alter that attribute mapping. It does NOT suggest or promote the use of the "Attribute Matching" method for associating a card to an DS account (Non-PKINIT). > One thing I’ve noticed is that the PKCS#11 shim is gone in Mountain Lion. Even after this new installer. The "PKCS#11 shim" (/usr/libexec/SmartCardServices/pkcs11/tokendPKCS11.so), as are the Tokend modules, is based on the deprecated CDSA. The Source Code for this module has been posted on the SmartCardServices project @ MacOSForge for 3 years now [1]. It has been in the Projects Trunk for almost two years [2]. You are correct that aside from the source code, a binary has not been included to date with the SCS Releases at Mac OS Forge. That doesn't mean it won't happen, just that it has not happened to date. > At NASA we had been told Apple and OS X Forge stopped this effort and have heard nothing since; I personally notified the community about the deprecation of CDSA in OS X Lion and that the Tokend modules would no longer ship in OS X starting with OS X Lion, but who said that "Mac OS Forge" (not "OS X Forge") had stopped any effort on this ? I know of no such statement being made by anyone from the Project. I will openly admit that It is currently not a hot item undergoing further development at this time, but anyone desiring to contribute to or work on the TokendPKCS11 Shim is more than happy to do so via the Ticketing System . > so the new installers mentioning the PKINIT implementation is a surprise to us. This is nothing new since Mac OS X Snow Leopard v10.6! It still exists and was provided for ongoing support for users around the world. There are people in many other countries that use Smart Card Services in OS X. It is not limited to the US Federal space. [1] http://smartcardservices.macosforge.org/trac/browser/branches/tokend/pk11-0… [2] http://smartcardservices.macosforge.org/trac/browser/trunk/TokendPKCS11 - Shawn __________________________________________________ Shawn Geddis geddis(a)me.com Security Consulting Engineer geddis(a)apple.com MacOSForge Project Lead: Smart Card Services Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo __________________________________________________ On Sep 28, 2012, at 9:30 AM, "Disiena, Ridley J. (GRC-VO00)[DB Consulting Group, Inc.]" <ridley.disiena(a)nasa.gov> wrote: > I meant, I had not seen this announce yet, at all. And yes I am aware we are told all things smartcard are supposed to be on another list, but I had not seen it announced anywhere and to be honest, I feel it is very relevant on this list since we have Federal mandates like M-11-11. It is the main reason I’m on this list. > > One thing I’ve noticed is that the PKCS#11 shim is gone in Mountain Lion. Even after this new installer. > > Also, if anyone in the Federal Government is working with a PKINIT implementation based on native support, please contact me. At NASA we had been told Apple and OS X Forge stopped this effort and have heard nothing since; so the new installers mentioning the PKINIT implementation is a surprise to us. We’d like to check out anything new in this area. > > -Ridley > > From: fed-talk-bounces+ridley.disiena=nasa.gov(a)lists.apple.com [mailto:fed-talk-bounces+ridley.disiena=nasa.gov@lists.apple.com] On Behalf Of Disiena, Ridley J. (GRC-VO00)[DB Consulting Group, Inc.] > Sent: Friday, September 28, 2012 8:36 AM > To: Fed-talk(a)lists.apple.com > Subject: [Fed-Talk] Updated smartcard installer? > > I didn’t see this announced yet on this list: > > http://smartcardservices.macosforge.org/trac/wiki/installers > > (1) **NEW** Smart Card Services Update v2.0.b2-MtLion (Sep 18, 2012) > OS Requirement: OS X Mountain Lion v10.8 > SHA-1 Hash: 4b012dd7a8f39f68311a6f48aa734c9231ac1e3f > This installs the Tokend modules which no longer ship from Apple as part of Mac OS X beginning with OS X Lion (v10.7). Note that this installer will ONLY install onto OS X Mountain Lion v10.8. The Tokend modules installed are: BELPIC, CAC, CACNG, JPKI and PIV. > > New to this release: > • JPKI.Tokend - Build 38522 added to the update to support LASCOM in Japan. > • cacloginconfig.plist - Default configuration file as optional install for those using Attribute Matching or PKINIT configurations. > • SystemCACertificates.keychain - Automatically added to the Keychain Search List if not already present. > > > > Interesting that they are still suggesting attribute matchine, is that not worse than using a password? > > Ridley DiSiena - CISSP > ETADS - ICAM Device Integration (IDI) / NASA ICAM Engineering > ridley.disiena(a)nasa.gov

1 0

Re-Compile SmartCardServices under MacOSLion
by Olivier Dugeon 12 Jul '12

12 Jul '12

Dear all, I have recently switch myPKI PKCS15 to a PKCS1 .NET. To have it working on MacOS Lion, I start to download and recompile the SmartCardServices project as the pkg provided by the project doesn't contain the PKCS11 tokend and the PKCS11 .NET library. I also look at the Gemalto software, but this one support only Snow and Leopard. Unfortunately, I try both darwinbuild (like indicated in the web page of the project) and xcodebuild without success. The compilation end with an error as it doesn't found the security_utilities include. I google this item, but found nothing useful. Can you tell me what I miss ? Where can I found this lib ? Thanks for your help. Olivier

1 0

I do not see any certificates on the card ActivIdentity USB Token (Activkey SIM NOV)
by Fernando Lemos de Mello 02 Jul '12

02 Jul '12

Hello, I am working in a MAC OSX 10.7.4 (Lion), and have installed macosforge Smart Card Services Update v2.0b1 trying to make my ActivIdentity USB Token (Activkey SIM NOV 11) recognized. After the install, when inserted, I do see a CAC-xxx-xx... in the Keychain. Keychain apparently unlocks the card, however I do not see any certificates on the card. The certificates are available when using ActivClient under Windows. What can we do to make it supported under MAC without having to purchase ActivClient ? I also opened a defect (#91). Thanks, Fernando

2 1

Smart Cards and Active Directory
by Sallah, Kebba [USA] 21 Apr '12

21 Apr '12

Hello My question is, what type of solutions are there for implementing Smart Card logon for a MAC with integration of Active Directory. We are interested in joining a MAC to an Active Directory domain and being able to perform a domain login with a Smart Card. Is it possible without a third party app? PKE Engineering Support

3 2

/etc/authorization for OS X Lion ?
by Yoann Gini 09 Mar '12

09 Mar '12

Hello, I’m new on this mailing list and I think a lot of people already ask that, but I’m looking for a solution for OS X Lion logon with smartcard. I’ve installed SmartCardService and OpenSC, my smartcard reader is see by my system, I can configure my cards with it, the keychain can see it too and mail can sign outgoing mail with it, so everything goes well when the user is logged. Now I try to allow user to be authenticated by the login window with the smartcard and I can’t find any documentation for the modification of /etc/authentication database… Someone have a link for that ? With 10.7.3 it’s seems to work, at least Centrify has do it : http://community.centrify.com/t5/The-Centrify-Apple-Guy/OS-X-10-7-3-and-Sma… So we should be able to do that with OpenSC devices ? Best regards, Yoann Gini

1 0

Smartcard Login and Kerberos (UNCLASSIFIED)
by Bruno, David L CIV (US) 07 Mar '12

07 Mar '12

Classification: UNCLASSIFIED Caveats: NONE Hello, Due issues with smartcard Login in 10.7.3 we cannot solely deploy it as the only means of authentication. In Snow Leopard I was never able to get smartcard login and Kerberos to work together. Does anyone know if this has changed in Lion 10.7.3? Has anyone successfully setup smartcard login as well as Kerberos login? Thank you _______________________ David Bruno Security +, RHCT, CCNA, CCA Computer Scientist U.S. Army Research Laboratory Scientific Computing Branch 410-278-8929 david.bruno(a)us.army.mil Classification: UNCLASSIFIED Caveats: NONE

1 0

Continuously having to delete Microsoft Intermediate Certificate
by Jenny Matheney 05 Mar '12

05 Mar '12

0"¢ *H÷ "0"10 +0) *H÷ Content-type: multipart/alternative; boundary="B_3413791661_1622329" > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3413791661_1622329 Content-type: text/plain; charset="ISO-8859-1" Content-transfer-encoding: quoted-printable I have spent a ton of time on the internet, Fed-talk, SmartcardServices and other communities over the past couple of months trying to figure this one out... And perhaps a keychain forum would be a better one to ask this question of but since Shawn seems to be the all knowing god of SmartCard/Keychain/Authentications/etc... ;-) I=B9m reeeeeaaaaalllllly hoping this forum has the answer. So! Here goes. I am using Entourage as my mail client to connect to webmail.east.nmci.navy.mil. I started receiving an error =B3unable to establish a secure connection to <servername> because the root certificate is not installed.=B2. Then every time I would receive an email from any .mil account I would get this pop-up that said verifying certificates that would hang and then of course report back there is a security problem. Click on details and get a red X =B3You do not trust the digital ID=B2. I followed ever= y line of advice I could find with the only solution that worked being to delete my Microsoft Intermediate Certificate. This works for a little whil= e but then an email will come in that causes this problem to reappear. And off I go back to my Username>Library>Keychains> to drag the Microsoft Intermediate Certificate to the trash again. I=B9m sure I=B9m not doing myself any favors by continuously deleting this either.... There has to be a more elegant solution out there... It=B9s hugely annoying in Entourage but causes problems when I OWA in properly using Safari or FireFox as well. Is there a method for identifying the offending keychain and deleting/blocking it from ever appearing again? Help? I hope you guys have an answer for me and thanks for your time. Jenny ~KCCO --B_3413791661_1622329 Content-type: text/html; charset="ISO-8859-1" Content-transfer-encoding: quoted-printable <HTML> <HEAD> <TITLE>Continuously having to delete Microsoft Intermediate Certificate</TI= TLE> </HEAD> <BODY> I have spent a ton of time on the internet, Fed-talk, SmartcardServices an= d other communities over the past couple of months trying to figure this one= out... And perhaps a keychain forum would be a better one to ask this quest= ion of but since Shawn seems to be the all knowing god of SmartCard/Keychain= /Authentications/etc... ;-) I’m reeeeeaaaaalllllly hoping this forum h= as the answer.  So!  Here goes. I am using Entourage as my mail client to connect to webmail.east.nmci.navy= .mil.  I started receiving an error “unable to establish a secure= connection to <servername> because the root certificate is not instal= led.”.  Then every time I would receive an email from any .mil ac= count I would get this pop-up that said verifying certificates that would ha= ng and then of course report back there is a security problem.  Click o= n details and get a red X “You do not trust the digital ID”. &nb= sp;I followed every line of advice I could find with the only solution that = worked being to delete my Microsoft Intermediate Certificate.  This wor= ks for a little while but then an email will come in that causes this proble= m to reappear.  And off I go back to my Username>Library>Keychain= s> to drag the Microsoft Intermediate Certificate to the trash again. &nb= sp;I’m sure I’m not doing myself any favors by continuously dele= ting this either.... There has to be a more elegant solution out there... It= ’s hugely annoying in Entourage but causes problems when I OWA in prop= erly using Safari or FireFox as well. Is there a method for identifying the offending keychain and deleting/block= ing it from ever appearing again?  Help? I hope you guys have an answer for me and thanks for your time. Jenny ~KCCO </BODY> </HTML> --B_3413791661_1622329-- `00ð õ0 *H÷ 0]10 UUS10U U.S. Government10 UDoD10 UPKI10UDOD EMAIL CA-240 100422000000Z 130421235959Z0w10 UUS10U U.S. Government10 UDoD10 UPKI10 UUSN1$0"UMATHENEY.JENNY.A.10702820260"0 *H÷ 0 ©FMVR@æÀÐ d_5%<B*MŸlqšñ »ZŠ #ÒÊÊWa»³- oãI.=DêNdg?Á#c[€úà°ÏNu®Ns$ã_Ÿµl$iœÊ^H³Àêº°è`ìo1Û3Ešý¬F6l>pê1©€âé'Ê=¡Ð<àpõ%Gà4\džîuµâÐÛô1¿}KÉ:,_ßí$ÅâpvöÎÔUÃÚéLËö)ÂÂëit V'µ¶ty|,W®[5ŽV!üÝö¬CpçÁ©$áòCø>HöÍ!"[£µ0±0U#0Tªs*Ç³wêÍ"@yH{û§"0?U80604 2 0.http://crl.disa.mil/getcrl?DOD%20EMAIL%20CA-240UÿÀ0#U 00 `He 0 `He0UQ ÖQì4êO_âïžÁw0m+a0_0;+0/http://crl.disa.mil/getsign?DOD%20EMAIL%20CA-240 +0http://ocsp.disa.mil0BU;09jenny.matheney(a)navy.mil +7 1070282026@mil0U 00+ 1US0)U%"0 +7++0 *H÷ m$2)qvÒCë~€X#üºz\€#¶ÉzTý4ÔS1ê©MÑÀ8]Ú¯ÏU»R²!ÉØ1Ë±ÛüìÝ+Fš¯r?L;Ûä8üxgj#kÿ|ãVêÕd(Ê[œô¯+Ÿ|$BÏY+eH@êÓ&`¿Ë×$Gy¬O°8N$Q`Frm(G°OCÖÆi_>ä§`±Úb#Å*cÂ&€·8B).6s©ý@[§Z¢Û|?ÀM»ºqÁÄB m®¡ØW«%9Gy¶ãá"çðR$ñÿÝ& ±¥ Kù¬Îº00w E0 *H÷ 0[10 UUS10U U.S. Government10 UDoD10 UPKI10U DoD Root CA 20 090126202615Z 150125202615Z0]10 UUS10U U.S. Government10 UDoD10 UPKI10UDOD EMAIL CA-240"0 *H÷ 0 ¥.Xz¡Þæ[öñÕÔÜ5#{n(dtp<ÌÂt<9! N ×7šÒÉÆ'(úU×²Î2Œðyõh«.ÌÏ7²ø eI %ÁŒj BmŽ¡B"«Ú9^Wk`Þ~hj~Aõ8zý²ÒâK6b¶ì%»Ð§£ÍQš÷ÒyU4&£ä\Í»h&t 7¡æ¯Íä>GÿÂGŒeº2)£ðÂ¢[zê²J}ÆÃn¬œO©v:=,*0Ž÷È Ò:|ÐZµú 0~ÖÑÇ¶C'±(©ã³xßbdENÍ¯®X6ß£Z0V0Uÿ0U#0It»^ºzþTï{ ÆÆ p0UTªs*Ç³wêÍ"@yH{û§"0U$00Uÿ0ÿ0U 00 `He0 `He 0 `He 0 `He0 `He0 `He0 `He0 `He0 `He0 `He 0 `He0?U80604 2 0.http://crl.disa.mil/getcrl?DoD%20Root%20CA%2020þ+ñ0î0?+… +0http://ocsp.disa.mil0+0|ldap://crl.gds.disa.mil/cn%3dDoD%20Root%20CA%202%2cou%3dPKI%2cou%3dDoD%2co%3dU.S.%20Government%2cc%3dUS?cACertificate;binary0 *H÷ rÜ9scMé7Ï²íØM÷2J³Êºó¬qf1Š*œº}TØ/ cJèl¡ì^{V0-ÈÒí×GDiÏoËØçRuµQÈªið0ðÇ6œÎÞ;vý ÎË¶ºÖñ\Ê¯èš¬-ÖvPì6ú£ßÆ2êÇsFü/Äè'HÂF6öìíg2ž¢à·Ò^!aCl}ó;keíãÛšÿÅ²çë_îï¿ó9³õÒÕÃlJ:l?¯è[6[Š&FFkÇÔªç®ž+Nú!r_¯Žî[É)|éÜxâNàtÒxf¢Çš0œ0¥ õ0 *H÷ 0]10 UUS10U U.S. Government10 UDoD10 UPKI10UDOD EMAIL CA-240 100422000000Z 130421235959Z0w10 UUS10U U.S. Government10 UDoD10 UPKI10 UUSN1$0"UMATHENEY.JENNY.A.10702820260"0 *H÷ 0 À 2S»äÇtÆ u€'^µV¥±b*³ŸîMB°4 -Ô D/zÈ;ü'TÖÐ~wÚ×\xPÆpŒÊJéŒ»ÎÈK¯át°ùoRÂœÅËT*2cÂ?ŽF²Y*É±ó#¯Òp`ÏÑÄ·)]èÎQO38ÞOéÑË!¬7b-XØ{dcÓrwl?OÈŽä£â.ä»As&KÙóŸrpÈÛõp`IKS©(|s9_Î_Pd€¬8€ Ñ¥·~*Ùæ¯ÞAl7ÃMÔW&®9Uûb:]«RÑ6ß9sÍ©)ÝÉv9,B\£j0f0U#0Tªs*Ç³wêÍ"@yH{û§"0?U80604 2 0.http://crl.disa.mil/getcrl?DOD%20EMAIL%20CA-240Uÿ 0#U 00 `He 0 `He0Uµ{ ädToIüfÿåXðx0m+a0_0;+0/http://crl.disa.mil/getsign?DO… +0http://ocsp.disa.mil0"U0jenny.matheney(a)navy.mil0U 00+ 1US0 *H÷ inPÒnm(C §d+CW¯6_Ž=b¬JÏGqÐ(IG ªÅÒ*IÒîÈ©ñJMÃÑy}DÅÿÚ x\iÂÏÒ^òÅe»<©·ºµ1wö·µ0æåfæ\¢ê(äCq ÏÌ5ì??âíCVíB0hj¢wæbÐcë ÓÅëgÂ'"£â'/¿RõwMÝ .FÞÞ!ÁÃY¥-êHÌdV10Žâ8=fq:ŽÙphŠ€æŽêYîo)^{"=êŠkÂœ:aÜ>-ðüÕôKNÌtNl ÛŒ©)vÂ€ÀøCæ1ê0æ0d0]10 UUS10U U.S. Government10 UDoD10 UPKI10UDOD EMAIL CA-24õ0 + ]0# *H÷ 1€dÑ.¬aö gpÛ Wpœ0 *H÷ 1 *H÷ 0 *H÷ 1 120305172741Z0 *H÷ -1ËñÍânw ~€ŠG¬-â±f í¯7'üd<ÖO{øâ×å©¶õŽ|GÝ€nRGÀ»Z}%³ê³ž'9¿ØËMÉp§æÞå/3ih?žÑð£¬Ñn'£ð{ÖBÜÑ€Ë$ýå<ôWpCBÞ©óê€{Ä»1wY0ÚÂÂgÁ5ªíœ7t0G¬ö²c+I:-ñz8¥7#Þ±¢"¯ê;Wmd%ØNÄ2óð0`e-wÿSs~ÛBD5E88éWÇ3E·"XÌeªå¢ ÏÈ@¯ïìÿ"ÉOhšìÏ6

2 1

Searching Directory Services for certificates in Lion
by JEFFREY COMPTON 05 Mar '12

05 Mar '12

Is anyone else having trouble with Mail.app in Lion searching directory services for certificates? From command line - it works like a charm - for example -- security find-certificate -e mycoworker(a)ourdomain.org -p > downloadedcert.pem; security import downloadedcert.pem -k login.keychain But from Mail.app - no go. Even searching the contact in the GAL displays the correct cert for the contact. Thanks.

4 4

Storing Keychain data
by SB Tech 04 Mar '12

04 Mar '12

Hi, I looked into using a Smart Card for authentication purposes in my SOHO, but came away disappointed by its interaction with Keychain Access. Specifically, because it took the top position in the Keychain list, it assumed the Login keychain's duties; but because I was unable to store passwords directly on the Smart Card (eg. wifi passwords) I found myself having to authenticate a second time, to the Login keychain. In the meantime, there was no automatic authentication of login services such as connecting to wifi or mounting of secure disk images. So, my question is: how does one go about using a Smart Card to store Keychain Access-specific data, so that the Smart Card "dynamic keychain" can more fully perform the functions required on login? At the moment, I'm not concerned with any particular Smart Card or software solution, I'm more interested in knowing whether it's actually possible. Regards.

5 10

Re: [SmartcardServices-Users] Smart Card Fixes in OS X Lion 10.7.3
by David Emery 10 Feb '12

10 Feb '12

At a minimum, the bug I saw earlier where I couldn't log in if Thursby PKard was installed AND my CAC Card was inserted into the reader is now gone. That's A Good Thing. dave

1 0