- SmartcardServices-Users - lists.macosforge.org

subscribe
by Collins, John C CIV USA USMA 22 Oct '10

22 Oct '10

subscribe ================================================ John C. Collins, CISSP, MCITP: Ent Admin, Security A+ Computer Support Group Lead Technician Electrical Engineering & Computer Science Founded in 0001 1001 1000 1001 at the United States Military Academy (845) 938-8697 DSN 688-8697 ================================================

1 0

Re: [SmartcardServices-Users] [Fed-Talk] Re: Require smart card login
by Inati, Souheil (NIH/NIMH) [E] 14 Oct '10

14 Oct '10

Shawn, Ron and Paul are absolutely correct. Restricting to smartcard only cannot be done at the user level in the AD. It HAS to be done at the client side, or else many other things will break. What we are trying to do is protect a computer that contains sensitive data. Requirements state that this has to be done with card/pin. There are many other apps we have at the NIH that authenticate against the AD, some are name/password only, some are either name/password OR card/pin, and some (eventually anyway) will be card/pin ONLY. Now, whether the management on the client side is done via AD computer management or an MCX record or a modified /etc/authorization file or a bit of specialized code in a login script, it absolutely does not matter. The point is to protect a particular asset, a computer that contains sensitive data. -Souheil On Oct 13, 2010, at 4:21 PM, Ron Colvin wrote: > On 10/13/10 3:59 PM, Shawn A. Geddis wrote: >> Organizations apply policy such as requiring smart cards by managing >> their AD. This is not something that they would do at the client >> side. What is managed on the client side would be any necessary mods >> to support the required authentication methods (ie. manage or install >> client side middleware such your ADmitMac for CAC). >> >> The Mac would be bound to AD (for Authentication and Authorization) >> hence if AD requires ONLY Smart Cards then the Mac User would only be >> able to authenticate via smart cards. Whether the client system is OS >> X or Windows the end result is the same --- management of forced >> authentication methods is at the Directory Service. >> > Shawn I could definitely see a use case for smartcard only at console to > require two-factor authentication for a client box. I see a different > use case for requiring only a smartcard ever for that account. I could > certainly see a different use depending on what type of data the client > processes and whether it is a mobile workstation or a smartphone. On or > off for the user account only is not sufficient. > > -- > > > *************************************************************** > Ron Colvin CISSP, CEH > Enterprise Integration Engineer, Security Analyst Code 700 > DCSE Code 100& 110 > NASA - Goddard Space Flight Center > <ron.colvin(a)nasa.gov> > Direct phone 301-286-2451 > NASA Jabber (rdcolvin(a)im.nasa.gov) AIM rcolvin13 > NASA LCS (ronald.d.colvin(a)nasa.gov) > **************************************************************** > On Oct 13, 2010, at 4:17 PM, Paul Nelson wrote: > If the original poster wanted to prevent users from logging into the Mac unless they had a smart card, they could do this the way you suggest below. > However, that may prevent them from using a password with their account for other reasons (run as for example). > > While you can set an AD account to "require smartcard login", that prevents a password from being used for ANY purpose. Microsoft clients also look for a group policy item "ScForceOption" that means a user must use a smartcard for interactive logon. > > Paul > > On Oct 13, 2010, at 2:59 PM, Shawn A. Geddis wrote: > >> Paul, >> >> Organizations apply policy such as requiring smart cards by managing their AD. This is not something that they would do at the client side. What is managed on the client side would be any necessary mods to support the required authentication methods (ie. manage or install client side middleware such your ADmitMac for CAC). >> >> The Mac would be bound to AD (for Authentication and Authorization) hence if AD requires ONLY Smart Cards then the Mac User would only be able to authenticate via smart cards. Whether the client system is OS X or Windows the end result is the same --- management of forced authentication methods is at the Directory Service. >> >> - Shawn >> _____________________________________________________ >> Shawn Geddis - Security Consulting Engineer - Apple Enterprise >> >> >> >> On Oct 13, 2010, at 3:24 PM, Paul Nelson wrote: >> >>> Shawn, >>> >>> How does one apply organizational policies such as "smart card required" to the Apple 10.6.3+ PKINIT solution? >>> >>> Paul >>> >>> On Oct 13, 2010, at 2:01 PM, Shawn A. Geddis wrote: >>> >>>> Before everyone claims what is and isn't the issue, we need to understand the actual setup that Souheil is using. >>>> >>>> Souheil, >>>> >>>> There are multiple methods supported for using Smart Cards for Authentication & SSO on Mac OS X 10.6. >>>> >>>> What method are you using today ? >>>> >>>> Old methods still supported: >>>> - PubKeyHash >>>> - This is a simple Hash matching between card and account >>>> - The user is then presented with a PIN Challenge which >>>> wraps/unwraps/verifies challenge - uses Private key on Card to prove ownership of card >>>> - uses sc_auth to update the DS with appropriate ";pubkeyhash;" and <hash> entries >>>> - Attribute Matching >>>> - This allows for selective attributes from Smart Card Login Certificate (ie. NT Principal Name) >>>> to be used for mapping to a single DS attribute (ie. UserPrincipalName) >>>> - uses /etc/cacloginconfig.plist mapping to define lookup in DS >>>> >>>> >>>> Mac OS X 10.6.3+ >>>> - PKINIT (initialization of Kerberos Session [TGT] with Auth from X.509 Cert) >>>> - SSO to Directory Service of choice (ie. AD) >>>> simplified explanation of process >>>> - System Bound to DS (ie. AD) >>>> - Utilizes NT Principal Name along with the Cert with EKU of Smart Card Login ( 1 3 6 1 4 1 311 20 2 2 ) >>>> --relies on /etc/cacloginconfig.plist to reference the NTPrincipalName >>>> - Request for Auth to KDC - acquires a TGT >>>> - uses PKINITMechanism configured in /etc/authorization/ for Login and ScreenSaver >>>> - Success: Access to HomeDir and subsequent Service Tickets >>>> - ... life continues ... >>>> >>>> Also, copying SmartCardServices-Users Mailing List where this discussion should be taking place >>>> >>>> - Shawn >>>> _____________________________________________________ >>>> Shawn Geddis - Security Consulting Engineer - Apple Enterprise >>>> >>>> >>>> On Oct 13, 2010, at 2:00 PM, Paul Nelson wrote: >>>>> You probably are not configured to verify the user's smart card credentials with AD. The Mac only matches the user account, and checks the certs to see if they are trusted. >>>>> >>>>> If you want true AD login with single sign-on, you could check out Thursby's ADmitMac PKI. This software obtains Kerberos credentials using a PIV card, and will configure itself using group policy so that you can enforce smart card logon that way. It also configures your system keychain with necessary certificates from Active Directory and group policy. >>>>> >>>>> Paul Nelson >>>>> Thursby Software Systems, Inc. >>>>> >>>>> On Oct 13, 2010, at 12:14 PM, Inati, Souheil (NIH/NIMH) [E] wrote: >>>>> >>>>>> These machines are bound to the NIH active directory and I only care about domain users for now. I haven't had to use sc_auth, the AD lookup based on the card credentials has been working fine. >>>>>> >>>>>> >>>>>> On Oct 13, 2010, at 12:51 PM, Qureshi, Usman wrote: >>>>>> >>>>>>> Have you tried using the sc_auth command? Is the user a domain user or a >>>>>>> local user? >>>>>>> >>>>>>> -----Original Message----- >>>>>>> From: fed-talk-bounces+usman.qureshi=unisys.com(a)lists.apple.com >>>>>>> [mailto:fed-talk-bounces+usman.qureshi=unisys.com@lists.apple.com] On Behalf >>>>>>> Of Inati, Souheil (NIH/NIMH) [E] >>>>>>> Sent: Wednesday, October 13, 2010 12:15 PM >>>>>>> To: fed-talk(a)lists.apple.com >>>>>>> Subject: [Fed-Talk] Require smart card login >>>>>>> >>>>>>> Hi all, >>>>>>> >>>>>>> Does anyone know the right way to set up /etc/authorization so that users >>>>>>> are REQUIRED to use a smart card? >>>>>>> A Snow Leopard 10.6 only solution is sufficient. >>>>>>> >>>>>>> Thanks, >>>>>>> Souheil >

3 5

Re: [SmartcardServices-Users] knowledge repository
by John Daly 13 Oct '10

13 Oct '10

Shawn, I know that a long time ago, you had written up several presos and guides to using smart cards on OS X, which I found invaluable. Any idea on when such guides might become available for the more recent implementations? The wiki seems to be missing administrative guides. If I'm just being dense and missing existing how-to guides on things like the PKINIT, kindly point me in the right direction, and I'll slink off quietly and look at them. Thank you, john On 10/13/10 1:37 PM, "smartcardservices-users-request(a)lists.macosforge.org" <smartcardservices-users-request(a)lists.macosforge.org> wrote: > I know I have conveyed it in many different forums, but there are many new > people on these lists who may benefit from this. -- John Daly Apple Certified Technical Coordinator Sysadmin 474300D

1 0

Re: [SmartcardServices-Users] [Fed-Talk] Re: Require smart card login
by Shawn A. Geddis 13 Oct '10

13 Oct '10

Before everyone claims what is and isn't the issue, we need to understand the actual setup that Souheil is using. Souheil, There are multiple methods supported for using Smart Cards for Authentication & SSO on Mac OS X 10.6. What method are you using today ? Old methods still supported: - PubKeyHash - This is a simple Hash matching between card and account - The user is then presented with a PIN Challenge which wraps/unwraps/verifies challenge - uses Private key on Card to prove ownership of card - uses sc_auth to update the DS with appropriate ";pubkeyhash;" and <hash> entries - Attribute Matching - This allows for selective attributes from Smart Card Login Certificate (ie. NT Principal Name) to be used for mapping to a single DS attribute (ie. UserPrincipalName) - uses /etc/cacloginconfig.plist mapping to define lookup in DS Mac OS X 10.6.3+ - PKINIT (initialization of Kerberos Session [TGT] with Auth from X.509 Cert) - SSO to Directory Service of choice (ie. AD) simplified explanation of process - System Bound to DS (ie. AD) - Utilizes NT Principal Name along with the Cert with EKU of Smart Card Login ( 1 3 6 1 4 1 311 20 2 2 ) --relies on /etc/cacloginconfig.plist to reference the NTPrincipalName - Request for Auth to KDC - acquires a TGT - uses PKINITMechanism configured in /etc/authorization/ for Login and ScreenSaver - Success: Access to HomeDir and subsequent Service Tickets - ... life continues ... Also, copying SmartCardServices-Users Mailing List where this discussion should be taking place - Shawn _____________________________________________________ Shawn Geddis - Security Consulting Engineer - Apple Enterprise On Oct 13, 2010, at 2:00 PM, Paul Nelson wrote: > You probably are not configured to verify the user's smart card credentials with AD. The Mac only matches the user account, and checks the certs to see if they are trusted. > > If you want true AD login with single sign-on, you could check out Thursby's ADmitMac PKI. This software obtains Kerberos credentials using a PIV card, and will configure itself using group policy so that you can enforce smart card logon that way. It also configures your system keychain with necessary certificates from Active Directory and group policy. > > Paul Nelson > Thursby Software Systems, Inc. > > On Oct 13, 2010, at 12:14 PM, Inati, Souheil (NIH/NIMH) [E] wrote: > >> These machines are bound to the NIH active directory and I only care about domain users for now. I haven't had to use sc_auth, the AD lookup based on the card credentials has been working fine. >> >> >> On Oct 13, 2010, at 12:51 PM, Qureshi, Usman wrote: >> >>> Have you tried using the sc_auth command? Is the user a domain user or a >>> local user? >>> >>> -----Original Message----- >>> From: fed-talk-bounces+usman.qureshi=unisys.com(a)lists.apple.com >>> [mailto:fed-talk-bounces+usman.qureshi=unisys.com@lists.apple.com] On Behalf >>> Of Inati, Souheil (NIH/NIMH) [E] >>> Sent: Wednesday, October 13, 2010 12:15 PM >>> To: fed-talk(a)lists.apple.com >>> Subject: [Fed-Talk] Require smart card login >>> >>> Hi all, >>> >>> Does anyone know the right way to set up /etc/authorization so that users >>> are REQUIRED to use a smart card? >>> A Snow Leopard 10.6 only solution is sufficient. >>> >>> Thanks, >>> Souheil

3 3

Smartcard support from third party dylib
by Lorenzo Dalrio 12 Oct '10

12 Oct '10

Hi all, I'm a system admin from Italy, I'm trying to make a smartcard working for login. The vendor provided us with a precompiled dylib. I'm able to use the smartcard with firefox by adding a new security device and passing the dylib as the provider. Same thing with openvpn. I have searched how to add a custom provider to smartcardservices to make it use the dylib but I haven't found anything useful. Could you please give me some tips about this problem? The secure.log shows those messages when the card is inserted: Sep 28 12:59:12 gollum com.apple.SecurityServer[22]: Token reader SCM SCR 355 00 00 inserted into system Sep 28 12:59:14 gollum com.apple.SecurityServer[22]: token in reader SCM SCR 355 00 00 cannot be used (error 229) Thank you in advance, Lorenzo Dalrio

3 9

Gemalto GCX4 72K Smart Card
by Jerry Roy 06 Oct '10

06 Oct '10

All...I have a new 10.4.6 SL installation, a new CAC card, SCR331 reader and the new CAC-NG(BETA v.0.95) SmartCard Services installed. In the Keychain App, the CAC shows as CAC (Not CACNG). Renamed CAC.tokend to noCAC.tokend, reinstalled CAC-NG services and rebooted several times hoping for different results (def: insanity). Still the same...CAC listes as CAC in Keychain, Safari won¹t open websites and continuously queries for a certificate. Will anyone suggest another avenue for me to pursue to fix this issue? Thank you in advance, Jerry

2 1

Help With Smart Cards
by iTanakh Support 09 Sep '10

09 Sep '10

Hello, Im new to this whole mailing list thing. I just purchased a contact-less smart card reader and I want to login to my mac os x server network using my card. Is this possible? Thanks, Nathan

2 1

[Announce] Smart Card Reader Available via Apple Online Store & Sales Teams
by Shawn A. Geddis 09 Sep '10

09 Sep '10

I am very pleased to announce the immediate availability of the SCM SCR3500 Smart Card Reader on both the Apple Online Store (US) as well as from your Apple Sales Team. Apple Store Link - (US Store ONLY at this time) -------------------------------------------------------- SCM SCR3500 Smart Card Reader http://store.apple.com/us/product/H2312LL/A Approvals -------------- GSA Approved http://www.scmmicro.com/fileadmin/products/datasheets/SmartFold_SCR3500_GSA… Mac OS X Support ------------------------- Fully supported by built-in CCID driver that shipped with Mac OS X. Recommended to use 10.5.6 and higher, 10.6.x Apple Smart Card Services Project @ MacOSForge - All development, questions, documentation (coming), etc. - http://SmartCardServices.MacOSForge.Org/ SCM Microsystem Product Datasheet -------------------------------------------------- http://www.scmmicro.com/fileadmin/products/datasheets/Dat_SCR3500_e.pdf ------------------------------------------------ SCM SCR3500 Smart Card Reader Overview The "SmartFold" SCR3500 mini USB reader is a fully ISO7816 compliant contact smart card reader. Due to its compact design the SCR3500 is ideally suited as a mobile reader device that can easily fit in the user's pocket or be attached to a key ring. Features • USB 2.0 full-speed • USB Bus Powered device • High-speed performance • CCID compliant • Supports ISO 7816 Class A, B, and C smart cards • Portable, small ergonomic design You can also contact your Apple Sales Team ! - Shawn _____________________________________________________ Shawn Geddis - Security Consulting Engineer - Apple Enterprise

1 0

tokenadmin, FileVault etc
by Juha Ratilainen 09 Sep '10

09 Sep '10

Greetings, Hope this is a correct place for these questions. I'm trying to utilize a smart token for various purposes, ultimately I'd like to have a single token for login, encrypting data either with FileVault or specific disk image, and VPN connection. FWIW, I'm using Charismathics CSSI, their tokend and plug'n crypt tokens. We are utilizing Open Directory, but having a lot of mobile users for which I'd like to use portable account (no synchronization). I have run into various problems with these aims and I'm hoping that someone could help with these. 1) I can use sc_auth to bind a token for login to an account. After that, I can also set screen to lock with token removal. However, after screen is locked I cannot use token's PIN anymore for login, only password is accepted even if I plug the token back. 2) tokenadmin create-fv-user fails for creating FileVaulted new account. sudo tokenadmin -v create-fv-user -u tokenuser -l "Token User" gives output: create-fv-user "-u" "tokenuser" "-l" "Token User" Authorizing right system.preferences.accounts Connecting to writeconfig... Connected Validating full name: Token User Validating short name: tokenuser 2010-09-07 13:00:17.908 tokenadmin[42782:e07] failed to convert string tokenadmin: Creating user "Token User" (tokenuser) Creating new user account: tokenuser 2010-09-07 13:00:18.354 tokenadmin[42782:e07] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '*** -[NSPlaceholderString initWithString:]: nil argument' *** Call stack at first throw: ( 0 CoreFoundation 0x00007fff85e95cc4 __exceptionPreprocess + 180 1 libobjc.A.dylib 0x00007fff85aa90f3 objc_exception_throw + 45 2 CoreFoundation 0x00007fff85e95ae7 +[NSException raise:format:arguments:] + 103 3 CoreFoundation 0x00007fff85e95a74 +[NSException raise:format:] + 148 4 Foundation 0x00007fff81819aaa -[NSPlaceholderString initWithString:] + 102 5 Foundation 0x00007fff81835e01 +[NSString stringWithString:] + 45 6 Admin 0x00007fff865d8274 -[User setPassword:] + 79 7 tokenadmin 0x0000000100001774 0x0 + 4294973300 8 tokenadmin 0x0000000100001085 0x0 + 4294971525 9 tokenadmin 0x0000000100000c8c 0x0 + 4294970508 ) terminate called after throwing an instance of 'NSException' Abort trap bash-3.2$ 2010-09-07 13:00:20.419 writeconfig[42783:903] writeconfig quitting because of exception:connection went invalid while waiting for a reply If I add -p, for optional password, a different error, this time account is created but creating sparsebundle fails: create-fv-user "-u" "tokenuser" "-l" "Token User" "-p" "tokenuser" Authorizing right system.preferences.accounts Connecting to writeconfig... Connected Validating full name: Token User Validating short name: tokenuser tokenadmin: Creating user "Token User" (tokenuser) Creating new user account: tokenuser Creating home directory... 2010-09-07 13:02:35.890 writeconfig[42815:903] DIHLFVMount failed with 80 tokenadmin: Failed to create home directory New user account created and configured 2) I could do without FileVault if I could create an encrypted image bound to token certificate. However, I haven't found an option to do this. hdiutil can create an encrypted container with path to a certificate as an argument. However, it doesn't understand a reference to a keychain that is a token. Any suggestions to overcome this? Thank you in advance for any replies, Juha Ratilainen

2 2

Help With Open Directory
by iTanakh Support 08 Sep '10

08 Sep '10

Hello, I purchase a blink (contact-less credit card or smart card) reader, and I was wondering if I can use a credit card to login to the server admin account. The reader is a SCL010 Smart Card Reader - SCM Micro Smart Card USB, purchased from antarespro dot com. I still haven't received it but I need help with middleware and software. Thanks, Nathan Niamehr

1 0