- SmartcardServices-Users - lists.macosforge.org

Re: [SmartcardServices-Users] MacOS Sierra version
by Daly, John L CIV NAVAIR, 4G0000D 20 Dec '16

20 Dec '16

When you are just using the built-in Sierra setup, and you insert your smartcard, what happens when you type security export-smartcard at the terminal? There doesn't seem to be any other way of telling if it actually reads your smartcard. it does not show up in the keychain any more. ___________________________________ Message: 4 Date: Mon, 19 Dec 2016 07:01:24 -1000 From: Brian Shiro <bshiro(a)usgs.gov> To: Smart Card Services-Users <smartcardservices-users(a)lists.macosforge.org> Subject: Re: [SmartcardServices-Users] MacOS Sierra version Message-ID: <85253D72-E765-4E9D-B6C3-B4CC1CECFC85(a)usgs.gov> Content-Type: text/plain; charset="utf-8" I tried the El Capitan version of Smart Card Services on Sierra with no success. The installer gave up immediately with an error saying the OS was wrong. Hoping Sierra's new built-in Smart Card tokends might work without having to install anything extra, I had tried that first. That too did not work. I did not know I had a Smart Card reader connected at all. Brian

5 6

MacOS Sierra version
by Shiro, Brian 19 Dec '16

19 Dec '16

When will a MacOS Sierra version of Smart Card Services be available? I have some new Macs that need it. Thank you, Brian

4 3

DavMail in .mil OWA environment
by J. Gregory Hass 05 Nov '16

05 Nov '16

Has anyone been successful in using DavMail as an Exchange proxy via OWA? I’ve been watching this for some time now as I need the capability. However, Apple put the use of tokend behind them since Mountain Lion or so. I know my question might be more accurately posted in the DavMail feed. However, there is little activity there and the last direct answer I received was to compile code. I understand that is a normal option for most deeply technical folks. However, I am not one of those talented folks. I’m simply a moderately technical business guy that needs the capability. So I see this feed and think, as it is related to CAC/SmartCard usage, I might find a smart person here who has solved my problem as it is related. Thanks!

2 1

impairing smart card in 10.12
by Daly, John L CIV NAVAIR, 4G0000D 03 Nov '16

03 Nov '16

If you don't want to use the terminal, If you go into Directory Utility, go into directory editor, go to users in the local/default node select the user in question, and click on AuthenticationAuthority to open the triangle. You'll see one entitled ;tokenidentity; If you delete that key, it will be unpaired. Today's Topics: 1. Unpairing Smart Cards in 10.12 (Will Coleman) 2. Re: Unpairing Smart Cards in 10.12 (Jorgensen, Will A) ---------------------------------------------------------------------- Message: 1 Date: Wed, 2 Nov 2016 20:21:50 +0000 From: Will Coleman <will.coleman(a)centrify.com> To: SmartCardServices-Users <smartcardservices-users(a)lists.macosforge.org>, Fed Talk <fed-talk(a)lists.apple.com> Subject: [SmartcardServices-Users] Unpairing Smart Cards in 10.12 Message-ID: <E11A9EBB-6F42-4269-8A30-3381C6708EE6(a)centrify.com> Content-Type: text/plain; charset="utf-8" Hi, Does anyone know how to undo or un-pair the linking of the certificates from the PIV card once you link them via the Sierra 10.12 linking process? I can?t seem to find any settings anywhere that store the paired card to the user. Thanks, ------------------------------

1 0

Re: [SmartcardServices-Users] Unpairing Smart Cards in 10.12
by Jorgensen, Will A 02 Nov '16

02 Nov '16

Using Terminal.app you can use sc_auth (see the man page) to do that or you can use dscl. Sc_auth is probablty the preferred method. Dscl . delete /users/[username] AuthenticationAuthority “;tokenidentity;[Subjectkeyidentifier from smartcard]” __________________________________________________ Will Jorgensen IT Engineer Feedback helps us grow! -----Original Message----- From: <smartcardservices-users-bounces(a)lists.macosforge.org> on behalf of Will Coleman <will.coleman(a)centrify.com> Date: Wednesday, November 2, 2016 at 1:21 PM To: SmartCardServices-Users <smartcardservices-users(a)lists.macosforge.org>, Fed Talk <fed-talk(a)lists.apple.com> Subject: [SmartcardServices-Users] Unpairing Smart Cards in 10.12 Hi, Does anyone know how to undo or un-pair the linking of the certificates from the PIV card once you link them via the Sierra 10.12 linking process? I can’t seem to find any settings anywhere that store the paired card to the user. Thanks, _______________________________________________ SmartcardServices-Users mailing list SmartcardServices-Users(a)lists.macosforge.org https://lists.macosforge.org/mailman/listinfo/smartcardservices-users

1 0

Re: [SmartcardServices-Users] [Fed-Talk] CAC-enabled login OS X10.7 & 10.8
by Shawn Geddis 02 Nov '16

02 Nov '16

Michael, All Smart Card related questions should be communicated on Apple's SmartCardServices Project Lists over at MacOSForge.org. A brief debunking of misinformation previously shared on this thread... There are three methods for associating a Smart Card to a given user account in either the local or remote DS. PubKey Hash - Default method used by OS X and requires sc_auth Attribute Matching - requires /etc/cacloginconfig.plist PKINIT - requires /etc/cacloginconfig.plist and Mac bound to a KDC All methods require that the smartcard-sniffer line be present in /etc/authorization for catching the Smart Card and gathering the PIN for the associated Challenge Response with the card for use of the Private Key on the card. Tokend modules no longer ship with OS X (as of OS X Lion), but are freely available for 10.7, 10.8 from Apple's SmartCardServices project at MacOSForge. This is why nothing happens when you insert a reader / card on a vanilla install of OS X Lion or higher. ALL other components of SmartCard Services are present and have even been updated in released versions of OS X since OS X Lion v10.7.0. Project Site: http://smartcardservices.macosforge.org/ Installers: http://smartcardservices.macosforge.org/trac/wiki/installers There are also third-party commercially supported solutions from, for example, Centrify, charismathics and Thursby. ".....Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism...." No, "smartcard-sniffer" is NOT a name change for PKINITMechanism. "smartcard-sniffer" performs a swap of the login window (dynamically) and captures PIN "PKINITMechanism" performs the Apple provided PKINIT services for Login Authentication. "...Unfortunately Apple dropped support and now it is a requirement in many places, all places that supply Windows-software for this but if you use OS X you have to find your own solution..." You have the SAME functionality still offered via my installers from Apple's MacOSForge Project You have multiple commercial solutions as well as noted above: Centrify, charismathics and Thursby. Please register and redirect ALL Smart Card related questions to one of the appropriate Mailing list on MacOSForge. http://lists.macosforge.org/mailman/listinfo Smart Card Users: https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Smart Card Developers: https://lists.macosforge.org/mailman/listinfo/smartcardservices-dev - Shawn ______________________________________________________ Shawn Geddis geddis(a)me.com Enterprise Security Consulting Engineer, Apple geddis(a)apple.com MacOSForge: Smart Card Services Project Lead: Web: http://smartcardservices.macosforge.org/ Lists: http://lists.macosforge.org/mailman/listinfo ______________________________________________________ On Feb 19, 2013, at 1:40 PM, Michael Kluskens <mklus(a)ieee.org> wrote: > I'm well aware of the sc_auth command and on previous versions of OS X I had CAC login enabled. However, in testing an OS X Lion and an OS X Mt. Lion system, inserting the CAC card has no effect. Both systems otherwise have full CAC functionality and I used the Identity Private Key. > > I have not yet tried this on a clean system with no security configuration (disabling suid's binaries, etc.) so it is possible that both systems have been broken with regards to CAC login. > > I was hoping someone could actually confirm what setup works on OS X 10.7 & 10.8 because at present the discussed information has not worked for me. > > Looking at /etc/authorization under system.login I see: > > builtin:policy-banner > loginwindow:login > builtin:reset-password,privileged > builtin:forward-login,privileged > builtin:auto-login,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > loginwindow:success > HomeDirMechanism:login,privileged > HomeDirMechanism:status > MCXMechanism:login > loginwindow:done > > and under authenticate I see: > > builtin:authenticate > builtin:reset-password,privileged > builtin:authenticate,privileged > PKINITMechanism:auth,privileged > > Comparing against 10.4 references these seem to indicate that smart card login is already enabled, besides the name change from smartcard-sniffer to PKINITMechanism. > > Michael > >> From: "Danberry, Michael J Mr ARMY GUEST USA" <michael.danberry(a)us.army.mil> >> The specific location for this information is at: http://militarycac.com/errors2.htm#OTHER_QUESTIONS. Question 2 > >> From: "Bomar, Matt W ERDC-RDE-ITL-MS Contractor" <Matthew.W.Bomar(a)erdc.dren.mil> >> >> Have you looked at the "sc_auth" command? It should allow you to associate >> a certificate with a local user account for CAC login. It's still present >> in 10.8. >> >> On 2/14/13 4:30 PM, "Michael Kluskens" <mklus(a)ieee.org> wrote: >> >>> What are the choices for CAC enabled login on OS X 10.7 & 10.8. >>> >>> I'm looking at OS X systems which may not have access to a MS Domain >>> Server, i.e. isolated network. Some would have access and some would not >>> have access all the time. >>> >>> I thought maybe some changes to /etc/authorization might reenable >>> CAC-login but I haven't started an attempt yet. >>> >>> Unfortunately Apple dropped support and now it is a requirement in many >>> places, all places that supply Windows-software for this but if you use >>> OS X you have to find your own solution.

2 1

Re: [SmartcardServices-Users] macOS update \ Clear History in Safari
by Blumenthal, Uri - 0553 - MITLL 28 Oct '16

28 Oct '16

I start with saying that I'm not a fan of OWA at all. :-) ‎I don't quite understand what actually is being cached by Safari. Is it a software token (like a cookie) that grants access for some time (regardless of whether the smart card is present any more)? If so, can OWA (or the Web server that OWA runs on) be configured so that it rejects "cookies" (or whatever those are) older that <your pre-defined acceptable time>? ‎If there's something else that's cached by the browser - being unfamiliar with what it can be, I'd appreciate details in order to maybe recommend something useful. Also, if the time during which that cache‎ entry would be accepted by OWA without CAC re-auth is fairly/reasonably small - maybe just living with it isn't such a bad compromise? Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network. Original Message From: patrick.krosbakken.CTR(a)eu.navy.mil Sent: Friday, October 28, 2016 11:11 To: uri(a)mit.edu Cc: smartcardservices-users(a)lists.macosforge.org Subject: Re: [SmartcardServices-Users] macOS update \ Clear History in Safari "Uri the Great", That was excellent news, tested it and it works fine except for one issue. Used it to login into an OWA site using my PKI token but Safari retains the cache and allows subsequence access without the PKI token. The only way I found to resolve the issue was to Clear History in Safari. An easy procedure but I cannot trust users to adhere to this procedure, and it would be considered a vulnerability. I am not using PKI token to log into my system. The computer is locked down with a DISA STIG for ver 10.11. Had the same issue using Thursby PKard. Do you (or anyone else) have a solution? Thanks, Patrick Krosbakken -----Original Message----- From: smartcardservices-users-bounces(a)lists.macosforge.org [mailto:smartcardservices-users-bounces@lists.macosforge.org] On Behalf Of Uri Blumenthal Sent: Friday, October 14, 2016 20:09 To: Jasmine Hall Cc: smartcardservices-users(a)lists.macosforge.org Subject: [Non-DoD Source] Re: [SmartcardServices-Users] macOS update/unable to install smart card reader On Oct 14, 2016, at 7:52 , Jasmine Hall <princessjazzyp(a)gmail.com> wrote: > My Mac just got an update to macOS Sierra. I’m trying to update everything i need in order to use the smart card reader but I can go no further because the latest on this website is for the macOS El Chapitan. When will an updated version of the installer come out?? If all you need your smart card for is login, and your smartcard-requiring applications are Apple Mail and Safari (and nothing else) - then you don’t need any more software, and Sierra is better at supporting smart card login than El Capitan could possibly be. Except that for smart card login to work you must set "System Preferences -> Users -> Login options -> Display login window as” to “List users”. Setting it to “Name and password” will make smart card login impossible (Apple bug, tracked at Radars 28542438, 28572563). If you need more, like using other browsers (Chrome and Firefox come to mind), MS Office (e.g., Outlook 2016), or Adobe Acrobat - then Sierra will break all of that for you. AFAIK, your only choice until Apple remedies this issue (tracked in Radars 27827716 and 28572661) is installing a different tokend (I usually recommend https://github.com/OpenSC/OpenSC.git and https://github.com/mouse07410/OpenSC.tokend.git) Then you’ll need to enable legacy smart card support via sudo security authorizationdb smartcard enable and disable the new Sierra’s pivtoken via sudo defaults write /Library/Preferences/com.apple.security.smartcard DisabledTokens -array com.apple.CryptoTokenKit.pivtoken It might be possible to just install SmartCardServices for El Capitan (and they might work correctly) on Sierra - but my preferred way that I’ve tested both at work and at home was described above. -- Uri the Great uri(a)mit.edu

1 0

Re: [SmartcardServices-Users] macOS update \ Clear History in Safari
by patrick.krosbakken.CTR＠eu.navy.mil 28 Oct '16

28 Oct '16

"Uri the Great", That was excellent news, tested it and it works fine except for one issue. Used it to login into an OWA site using my PKI token but Safari retains the cache and allows subsequence access without the PKI token. The only way I found to resolve the issue was to Clear History in Safari. An easy procedure but I cannot trust users to adhere to this procedure, and it would be considered a vulnerability. I am not using PKI token to log into my system. The computer is locked down with a DISA STIG for ver 10.11. Had the same issue using Thursby PKard. Do you (or anyone else) have a solution? Thanks, Patrick Krosbakken -----Original Message----- From: smartcardservices-users-bounces(a)lists.macosforge.org [mailto:smartcardservices-users-bounces@lists.macosforge.org] On Behalf Of Uri Blumenthal Sent: Friday, October 14, 2016 20:09 To: Jasmine Hall Cc: smartcardservices-users(a)lists.macosforge.org Subject: [Non-DoD Source] Re: [SmartcardServices-Users] macOS update/unable to install smart card reader On Oct 14, 2016, at 7:52 , Jasmine Hall <princessjazzyp(a)gmail.com> wrote: > My Mac just got an update to macOS Sierra. I’m trying to update everything i need in order to use the smart card reader but I can go no further because the latest on this website is for the macOS El Chapitan. When will an updated version of the installer come out?? If all you need your smart card for is login, and your smartcard-requiring applications are Apple Mail and Safari (and nothing else) - then you don’t need any more software, and Sierra is better at supporting smart card login than El Capitan could possibly be. Except that for smart card login to work you must set "System Preferences -> Users -> Login options -> Display login window as” to “List users”. Setting it to “Name and password” will make smart card login impossible (Apple bug, tracked at Radars 28542438, 28572563). If you need more, like using other browsers (Chrome and Firefox come to mind), MS Office (e.g., Outlook 2016), or Adobe Acrobat - then Sierra will break all of that for you. AFAIK, your only choice until Apple remedies this issue (tracked in Radars 27827716 and 28572661) is installing a different tokend (I usually recommend https://github.com/OpenSC/OpenSC.git and https://github.com/mouse07410/OpenSC.tokend.git) Then you’ll need to enable legacy smart card support via sudo security authorizationdb smartcard enable and disable the new Sierra’s pivtoken via sudo defaults write /Library/Preferences/com.apple.security.smartcard DisabledTokens -array com.apple.CryptoTokenKit.pivtoken It might be possible to just install SmartCardServices for El Capitan (and they might work correctly) on Sierra - but my preferred way that I’ve tested both at work and at home was described above. -- Uri the Great uri(a)mit.edu

1 0

macOS update/unable to install smart card reader
by Jasmine Hall 14 Oct '16

14 Oct '16

My Mac just got an update to macOS Sierra. I’m trying to update everything i need in order to use the smart card reader but I can go no further because the latest on this website is for the macOS El Chapitan. When will an updated version of the installer come out??

2 1

Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 01 Sep '16

01 Sep '16

Hi, Final update for this - Yubico have released a new version of the Yubikey PIV Manager tool (v1.3) for all platforms. I have tested a Yubikey 4 with Smartcard Services for MacOSX and I can confirm everything now works out of the box. See: https://www.yubico.com/support/download/ Thanks! David L > Hi, > > Just a quick status report to say that the the Yubico PIV tool now has a set-ccc command (along with the existing set-chuid command) > so that Smartcard Services will work with the Yubikey NEO and 4. See https://github.com/Yubico/yubico-piv-tool > > There is no need to modify tokend. > > Thanks, > > David L

1 0