- SmartcardServices-Users - lists.macosforge.org

CAC-NG
by Evans, Paul CIV NAVAIR Bldg 1463 17 Feb '10

17 Feb '10

All, I'm still having no luck with getting a 10.5.8 machine with the CAC-NG tokend module to work. As I've shared with the list before, it appears that when a CAC enabled server requests my cert, my machine never responds with one. None of the debug output points to an Identity Preference issue. So, has anyone on the list actually gotten a Mac running 10.5.8 to work correctly with a CAC-NG, or am I just tilting at windmills? Thanks, pe

1 0

Re: [SmartcardServices-Users] Request files necessary to support 144k CAC
by Shawn A. Geddis 12 Feb '10

12 Feb '10

The Tokend to support the new CAC-NG (CAC NExt Generation) for 10.6.x is not yet posted, but will be soon. I realize you are not using 10.5.x, but the version for that is posted. A notice will go out the moment the CAC-NG for 10.6.x is posted. -Shawn On Feb 10, 2010, at 1:21 PM, Skipper McCreight wrote: > Received a new 144k CAC which does not seem to work with OS X 10.6.2 with an Omnikey Cardman 3021. My previous CAC worked (but expired). Request POC developing drivers to support the new CACs. > > Any help you could provide would be VERY much appreciated! > > Thanks in advance. > > Skipper > > > William "Skipper" McCreight Jr. > SPAWAR Charleston > LAN Upgrade Technical and Operations Manager > Desk: (843) 218-5320 > Mobile: (843) 822-2159 (txt capable) > skipper.mccreight(a)nsoc.med.osd.mil __________________________________________________ Shawn Geddis geddis(a)mac.com Security Consulting Engineer geddis(a)apple.com MacOSForge Project Lead: Smart Card Services Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo __________________________________________________

1 0

New CAC problems
by Evans, Paul CIV NAVAIR Bldg 1463 08 Feb '10

08 Feb '10

All, I just received a new CAC today and I'm having issues with it on my MacBook Pro running 10.5.8. The new card is apparently the dual applet type (CAC and PIV). I found a post on the fed-talk list from Shawn Geddis back in November pointing to the beta tokend and installed it but it still doesn't work. The card seems to be recognized by the keychain app but when I click on it it doesn't show any certs or other information. When I try to unlock it, it won't accept the PIN. Are there any work-arounds? Thanks, pe

6 19

Ref: CAC NG (PIV) for Mac SmartCard Services (Keychain)
by Courtney, Valencia V LCDR USA NORAD USNORTHCOM HQs J64 28 Jan '10

28 Jan '10

Classification: UNCLASSIFIED I'm a Mac user running OS 10.5.8 and using Safari 4.0.4. with 100% success in using a pre-DOD CAC NG issued card (issued in 2007) on a SCR 331 USB reader firmware v5.25 and ActivIdentity USB reader v2.0. I'm able to bind the CAC-Email cert to an https URL using the Keychain Access app. However, Keychain Access is unable to read the certs on my newly issued (2010) DOD CAC. Can you tell me if the CAC-NG (BETA v0.95) Leo <http://static.macosforge.org/smartcardservices/downloads/installers/CAC-NG-v 0.95-beta-leo.zip> (Jan 26, 2010) will resolve this problem? P.S. I tested Keychain Access ability to read a friends DOD CAC issued in late (Nov) 2008 and the certs were viewable and able to add Identity Preference (bind) to a CAC enabled URL with successful access after entering PIN. Also I tried the trail version of ActivClient CAC for Mac which was not able to read the certs from a pre or post DOD CAC NG. For the DOD CAC NG issued card, ActivClient displays message unable to read card message after 5 seconds of trying. For pre-DOD CAC NG issued card, ActivClient shows blue status bar in a loop as if trying to read the card but the app does not reach an end-state after a minute or more running, i.e. neither an error message for display of certs. The DOD CAC NG issued card works with problems on Win XP OS using ActivClient v6.1 via a SCR 331 or SCR 3310. V/r, LCDR Vee Courtney N-NC/J644 (719) 556-0889

1 0

Re: [SmartcardServices-Users] How can I specify alternate OCSP URL in OCS X?
by Beck, Keith M CDR ACNO NGEN, OPNAV N099 05 Jan '10

05 Jan '10

> Date: Mon, 04 Jan 2010 15:37:05 -0500 > From: "Shawn A. Geddis" <geddis(a)apple.com> > To: Paul Kwan <paul.kwan(a)centrify.com> > Cc: SmartcardServices-Users Group > <smartcardservices-users(a)lists.macosforge.org> > Subject: Re: [SmartcardServices-Users] How can I specify alternate > OCSP URL in OCS X? >Message-ID: <D79F1050-DA34-4F6C-8C8D-4CC4294D5B90(a)apple.com> >Content-Type: text/plain; charset="us-ascii" > ... > >Paul, > >No. Mac OS X enforces what is in the certificate, because that is what can >be absolutely validated. > >There are third-party products which have incorporated additional services >to rewrite/process the Cert Revocation URI found in the Cert to a >*configurable* URI -- allowing you to go from CRLDistribution Points to AIA >Extensions (for OCSP). >__________________________________________________ >Shawn Geddis geddis(a)mac.com >Security Consulting Engineer The certificate URI is fine for me. Is there a way to accept an OCSP reply when the responder is using a self-signed root and isn't in the chain of trust for the certificate/CA? There is probably a good reason to the DoD OCSP certificates, but OCSP always fails for me, causing the huge delays for CRL download. Keith

1 0

Question on the roadmap
by Thomas Åkesson 05 Jan '10

05 Jan '10

Hi Shawn et al, It is very encouraging to see activity on the project timeline! It would be very interesting to know what the expected outcome of the 2 milestones defined on the roadmap is. Are you planning to provide a binary release when completing the "Mac OS X 10.6.0" milestone? I opened a ticket (#8) a few months ago which depends on a more recent build of pcscd. Is there any chance of seeing a binary release with an updated pcscd in the near future? Thanks for your efforts, Thomas Å.

1 0

pcscd failing on osx 10.6.2?
by Fabrizio Rizzo 05 Jan '10

05 Jan '10

When I plug in my ActivIdentity smartcard reader, I see the following error in the console: 12/7/09 2:35:45 PM com.apple.securityd[25] /SourceCache/SmartcardCCID/SmartcardCCID-35253/ccid/ccid/src/ccid_usb.c:746:ccid_check_firmware() Firmware (2.02) is bogus! Upgrade the reader firmware or get a new reader. This very likely explains why I my CAC certs are not showing up in the keychain. Can anyone confirm functionality with an ActivIdentity USB 2.0 Smartcard Reader (P/N: ZFG-9800GAE) on Mac OS X 10.6.2? Will this reader work, and if so, what is the correct version of firmware? Thanks, -- -- Fabrizio

3 6

BETA Tokend available: CAC-NG (Leopard Mac OS X 10.5.6+)
by Shawn A. Geddis 02 Dec '09

02 Dec '09

SmartCardServices - "CAC-NG" Tokend The SmartCardServices Project Team is pleased to provide access to the*BETA* for CAC Next Generation (a.k.a. CAC-NG) Tokend support for Mac OS X 10.5 "Leopard". Support for Snow Leopard is forth coming, but you can proceed to test with your Mac OS X 10.5.6+ machines with this installation. Background CAC-NG Smart Cards The following is an excerpt taken directly from the "DoD Implementation Guide for CAC Next Generation (NG), v2.5, November 2006". The DoD CAC Environment The PIV transitional, as defined in SP 800-73, is added to the existing CAC v2 card as an additional data model in conjunction with other evolutions such as the purse and access control. This CAC with PIV is called the CAC Next Generation (NG). The CAC NG is the first and most significant step towards the PIV end point solution. The PIV solution is implemented on the DoD CAC NG, but is largely separate and distinct from the DoD multi-application CAC. It will evolve at its own pace but in the same environment. The purpose and function of the CAC NG is much broader than the focused interoperability function of the PIV. In 1999, Congress directed the Secretary of Defense to implement smart card technology within the DoD with the objective of increasing efficiency, security, and readiness. The result has been the creation of the CAC. The baseline functionality of the CAC is to (1) provide for logical access to computer systems, (2) provide personnel identification, (3) enable physical access to buildings, and (4) PKI for signing, encryption, and non-repudiation. The CAC is the standard identification card for active duty military personnel, Selected Reservists, DoD civilian employees, and eligible contractor personnel. The CAC NG is a multi-application smart card. It serves as a token for PK identity, email, and encryption certificates. Additionally, it contains a linear barcode, two-dimensional barcode, magnetic stripe, color digital photograph, and printed text. Installer http://smartcardservices.macosforge.org/trac/wiki/installers Installation Smart Card Tokend Installation CAC-NG /System/Library/Security/tokend/CACNG.tokend __________________________________________________ Shawn Geddis geddis(a)mac.com Security Consulting Engineer MacOSForge Project Lead: Smart Card Services Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo __________________________________________________

2 3

OpenDirectory
by Michele (Mike) Hjorleifsson 29 Sep '09

29 Sep '09

Anyone integrated Smart Card Service logon with Open Directory ? Been looking for some how to's but no luck so far. I imagine it would be a matter of modifying the LDAP Authorization attributes, unless password server supports this which i dont think it does. __________________________ Michele (Mike) Hjorleifsson ACSA/ACT, MCT/MCP, CCA/CCI PH: 772-224-8913 FX: (888) 451-2879 This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual entity to whom they are addressed. This communication may contain material protected by the attorney-client privilege. If you are not the intended recipient or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying this e-mail or any file or files transmitted with it is strictly prohibited. If you have received this e-mail in error, please immediately telephone (772) 224-8913.

2 1

CCID drivers auto-start issues on the Snow Leopard
by Wang Yongqing 29 Sep '09

29 Sep '09

Hi, I have got the Snow Leopard OS on my Macbook and want to use the CCID driver on it. But when I plug-in the reader, there is no any information. So I cancel the autostart of pcscd and run the command in the terminal: "pcscd -f". The reader can not be used and the terminal give the information "pcscd: posix_spawn: pcscd: No Such file or directory". But the reader can run successfully when I run the command "/usr/sbin/pcscd -f". So I want to know whether I must disable the autostart of pcscd if I want to use the reader on the Snow Leopard? Wait for your reply. Thank you. Best regards, Yongqing

2 1