- SmartcardServices-Users - lists.macosforge.org

Italian social services smartcard
by Luca Accomazzi 08 Aug '16

08 Aug '16

First, a bit of context. I hold a doctorate on computer science, and it’s possibile that I’ve been using Apple computers since before you were born (this is a picture of the first original software package I bought: https://cuoredimela.accomazzi.it/images/1-software-per-apple-ii.jpg) but I know next to nothing about smartcards (even if I am familiar with DH theorem, keys, certificates, yadda-yadda). Now for the problem. All Italian citizens are issues one of these smartcards: http://www.migrando.it/UserFiles/Image/News/454_sanitatesserasanitaria.jpg we normally use them at the doctor’s and inside hospitals to be identified and to get appointments. For my next book, I’m trying to understand how it might be possible to use Macs to access some social services that a few Italian regions and the national administration are supposed to offer to their citizens via those things. Most administrations here ignore Mac users, all official websites but one do not offer instructions for macOS, the one that does suggests an incredibly byzantine procedure mandating the use of Firefox and last updated during Mavericks’s lifetime. For example, I’m supposed to be able to go here https://telematicisc.agenziaentrate.gov.it/ClientReg/Abilitazione/AbilitaSm… do a first access using my card and a PIN I’ve been issued, then go here https://telematicisc.agenziaentrate.gov.it/ClientAuth/Login and pay my taxes or ask for refunds. I’ve been googling the issue for the last couple of days and nobody here seems to make head or tails of this. I could only find a document saying that the card contains an X.509 certificate, RSA 1024 bit public-private keys and a few other personal identification informations. My dream is to be able to take the darn private key from my card (I do have a reader at hand, it’s an ACR38 from these guys: http://www.acs.com.hk/en/driver/4/acr38-smart-card-reader/) , save it in the Keychain and forget about the smartcard. If I were asked to engineer a security system I would not allow copying the private key, though, so I realize this is likely impossible. Help please (and I probably left of quite a few important details, so ask me anything). Thanks in advance, Luca

3 2

Re: [SmartcardServices-Users] Can MacOSX work with Oberthur ID-One PIV (type A) cards and ID Prime .Net from Gemalto?
by Hoit, Daniel S. 08 Apr '16

08 Apr '16

Uri, I’ve got it on my to do list to look at the OpenSC stuff again. If it does a good job supporting PIV, it might be something we could use. As for why someone would use the .Net cards, I can answer that pretty easily. They work with Microsoft’s Forefront Identity Manager, and are already in use in some places. We haven’t had any luck getting FIM to provision PIV cards. I don’t know that its not possible… but Microsoft has been less than helpful on providing the needed details, and it certainly seems like its simply not supported. We’ve been using the .Net cards for years, they are tied into our identity provisioning workflow, and so with mandates looming, it made sense to take what we already had working and adapt it for the new need. Were we starting from scratch, looking to support smart cards across three platforms, I don’t think we would go down that route. —DH On Apr 8, 2016, at 11:17 AM, Uri Blumenthal <uri(a)mit.edu<mailto:uri@mit.edu>> wrote: I know PIV is served well by OpenSC.tokend. If it would work with .Net cards (and I’ve no clue what those are, or why one would bother, when PIV and OpenPGP tokens are both available and reliable), going OpenSC route could be a good direct solution that doesn’t require contortions to get various .tokend compiled (as you know, I tried to use PKCS11.tokend, and failed). P.S. This email is signed by a PIV token in Gemalto Proxy-DU reader, using OpenSC.tokend. On Apr 8, 2016, at 14:07 , Hoit, Daniel S. <hoit2(a)llnl.gov<mailto:hoit2@llnl.gov>> wrote: Glenn, We are using both at LLNL, although we are looking into replacing the .Net cards since it causes issues switching libraries on the linux boxes. The .Net cards use the PKCS11.tokend module that Ludovic Rousseau wrote, along with a Framework and some libraries to provide the pkcs11 support. Unfortunately, the version that Gemalto is currently providing will only look in /usr/lib/pkcs11, and since that location is restricted on SIP enabled systems, it breaks. Luckily, the source for PKCS11.tokend is on the smartcard services web site, and Ludovic has an updated version there that will look in /usr/local/lib/pkcs11. Hopefully Gemalto updates their installer to use that version in the future, but in the meantime I simply pulled down the newer tokend code, built it, and packaged it with the existing libraries set to be put in SIP compliant locations. They do use different pkcs11 modules, so if thats part of your deployment, you may have issues. I can use the tokendpkcs11.so for generating a key off the .Net cards, but trying to use it with SSH it relays a signing error, and fails. Considering its doing the gemalto PKCS11 -> PKCS11.tokend -> tokendPKCS11.so, its not really surprising that its flakey. Most tools allow you to point to a separate library at the command line though, so you could always have an aliased SSH for the .NET card that uses -I /usr/local/lib/pkcs11/<whichever gemalto pkcs11.so you are using> The biggest issue with using a “civ” card along side the PIV is user mapping. Once we solved that, everything else has been pretty straight forward. I’d be happy to discuss the details of our implementation if you’d like. You know how to get ahold of me. :) —DH On Apr 8, 2016, at 10:32 AM, Machin, Glenn D <GMachin(a)sandia.gov<mailto:GMachin@sandia.gov>> wrote: We have a situation where will have users using a PIV (Oberthur ID-One PIV (type A)) and the ID Prime .Net from Gemalto. We want to make sure MacOSX can support both cards. Out of the box on MacOSX ID Prime .Net from Gemalto does not work and we want to make sure we don’t break the PIV to get the .Net card to work. We have found that on Linux (red hat) only one pkcs11 module will work at a time for either pam_pkcs11 or pam_krb5, and each card needs its own pkcs11 module, therefore only one card can be configured at a time. We don’t want to fall into the same trap with MacOSX. Appreciate any help. Glenn _______________________________________________ SmartcardServices-Users mailing list SmartcardServices-Users(a)lists.macosforge.org<mailto:SmartcardServices-Users@lists.macosforge.org> https://lists.macosforge.org/mailman/listinfo/smartcardservices-users Daniel Hoit hoit2(a)llnl.gov<mailto:hoit2@llnl.gov> 925.424.5256 _______________________________________________ SmartcardServices-Users mailing list SmartcardServices-Users(a)lists.macosforge.org<mailto:SmartcardServices-Users@lists.macosforge.org> https://lists.macosforge.org/mailman/listinfo/smartcardservices-users -- Uri the Great uri(a)mit.edu<mailto:uri@mit.edu> Daniel Hoit hoit2(a)llnl.gov<mailto:hoit2@llnl.gov> 925.424.5256

1 0

Can MacOSX work with Oberthur ID-One PIV (type A) cards and ID Prime .Net from Gemalto?
by Machin, Glenn D 08 Apr '16

08 Apr '16

We have a situation where will have users using a PIV (Oberthur ID-One PIV (type A)) and the ID Prime .Net from Gemalto. We want to make sure MacOSX can support both cards. Out of the box on MacOSX ID Prime .Net from Gemalto does not work and we want to make sure we don't break the PIV to get the .Net card to work. We have found that on Linux (red hat) only one pkcs11 module will work at a time for either pam_pkcs11 or pam_krb5, and each card needs its own pkcs11 module, therefore only one card can be configured at a time. We don't want to fall into the same trap with MacOSX. Appreciate any help. Glenn

2 1

tokendPKCS11.so
by Lance Terada, CTR 06 Apr '16

06 Apr '16

Hello, Doesn’t anyone point me to directions on how to build the tokendPKCS11.so for smartcardservices on El Capitan? It doesn’t seem to come with the pkg. Thanks, Lance

1 0

Unable to use Card Reader on Mac 10.11.3
by Eliya Voldman 31 Mar '16

31 Mar '16

I've got a Card Reader SCR33xx v2.0 USB SC Reader. I followed instruction from http://smartcardservices.macosforge.org/trac/wiki/installers and installed OS X El Capitan v10.11 Smart Card Services v2.1.2 [OSX 10.11] Then according to my company instruction I changed Settings for Certificates to 'Always Trust' When I tried to login to my company web site using Card Reader it failed to recognize the card. I talked to my company customer support and they said that officially they don't support this version but many people had success to use it. Then I tried to re-install and etc but nothing helped and I'm stuck. I can't delete Keychain CAC-000-.... I will attach a few files with my status. Please help ... it looks that I'm stuck Thanks

1 0

Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 29 Mar '16

29 Mar '16

Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, A little more then a year or so ago, starting right after i had to get a new identity Card, i started having trouble using the Tokend that was required to use my identification & pincodes in Safari & Keychain Access. Since my identity Card is from Belgium (Belpic Tokend from MacOSForge.org & Beid Tokend from eid.belgium.be) i have had contact with both these Mailing Lists & Fedict.be with a fix which is workable but not really a solution which is tight. The facts: • The Belgian developers have worked with Apple in the past, this delivered the Belpic Tokend which Apple has outsourced to MacOSForge & is still being updated by MacOSForge. • The Belgian Developers found Apple/MacOSForge to be to slow/unresponsive when they added patches & decided to work on their own, the new tokend is called Beid Tokend. • My old identity card used the 2nd version of encryption, my new one uses the 3th version. This made the Belpic tokend defunct & i had to change to the Belpic Tokend. • For unknown reasons on my Mac when using the Beid tokend i have to connect the reader with ID card at boot time to make sure it is recognized by the tokend & usable in Safari & Keychain. When i don’t do this i have a 1/10 chance it could still work, otherwise i need to reboot my Mac. This problem was not there when used the Belpic Tokend. • Notting is wrong with my reader (ACS ACR38) running with Apple’s own driver or the latest driver from ACS (i can uninstall the ACS driver if needed but this don’t change a thing) because if i use the JAVA application from Fedict or the Firefox plugin the card is accessed & working as supposed to. Only when it should use the tokend it fails as explained. So seeing these facts , i can presume & partly this is confirmed by the Fedict.be, that Apple only has the 1st & 2nd version of encryption while the Fedict also has the 3th & 4th version, The Identity Cards that are now issued use the 3th version & the 4th version will be used in future. Also but unconfirmed, i think Belpic because it is being developed & updated for new OS X versions by MacOSforge has kept full compatibility with OS X versions while Beid because it’s being developed by a 3th party with not enough intrest in OS X & unwillingly to work with MacOSForge is not 100 % bugler anymore & in my case a bug causes the behavior as explained above. To add to the pain, i also see in a recent post in SMC Users that the US CAC card has far more functionality then the the Belgian Identity Card, i suppose this functionality is being delivered by the tokend, the CAC tokend i suppose is being developed in a team effort by the US military & MacOSforge. The functionality i have in my mind here is the login in & switching on & off the screensaver or locking the computer by inserting the CAC card in the Card Reader connected to the Mac. I wonder if al this could be fixed somehow, even if the Fedict.be will not be cooperative ? You have both the Tokend’s & source code from CAC & Belpic & you can download the Beid tokend from above mentioned website, it’s inside an installer .pkg but i’m sure you can extract it without installing or even install it in a test environement. I hope you can use the beid tokend to get the 3th & 4th version of encryption without having the source code of it. But ofcource you could also ast the Fedict for the source or develepment kit & if this doesn’t work out, there is a Linux version which can be downloaded as source. I really hope you are willing to fix these issue’s because the Fedict seems not to. (i have a long contact with their support & in each new version they have asked me to test if the bug still exists but it has never been fixed) Yours sincerely Maccampus Belgian Mac OS X User

2 3

Re: [SmartcardServices-Users] Centrify vs Smart Card Services tokend
by Blumenthal, Uri - 0553 - MITLL 29 Mar '16

29 Mar '16

> I’m curious if anyone has insight into how the Centrify tokend is different > then the one that comes from the smart card services project. From what I can > see, they appear to be identical. I’m wondering if they are just compiling > and re-packaging the same code. I had the same impression. ;) I wonder if somebody would be kind enough to help me build SmartCardServices – I tried and failed miserably. Apparently the project file(s) aren’t enough. I’ve Mac OS X 10.10.5 and 10.11.4, Xcode 7.2.1 and 7.3, and my attempt to build fails because all the frameworks (and their include files) are not found (trying to add them manually did not help).

3 2

Centrify vs Smart Card Services tokend
by Jorgensen, Will A 29 Mar '16

29 Mar '16

I’m curious if anyone has insight into how the Centrify tokend is different then the one that comes from the smart card services project. From what I can see, they appear to be identical. I’m wondering if they are just compiling and re-packaging the same code. __________________________________________________ Will Jorgensen IT Engineer Communications & IT Directorate Pacific Northwest National Laboratory www.pnnl.gov<mailto:Jeff.Evans@pnnl.gov>

3 2

Re: [SmartcardServices-Users] Activate screensaver with token
by Daly, John L CIV NAVAIR, 4G0000D 28 Mar '16

28 Mar '16

Yoann, would defaults write com.apple.screensaver tokenRemovalAction 1 get around the caching issue? I note that my accounts do all show tokenRemovalAction 1, and pulling the CAC from the machine causes the screensaver to activate. It's just when I go to unlock the screensaver, the CAC doesn't work if it's a mobile or local account, only works if it's a network account. Thank you, John > Le 23 mars 2016 ? 19:10, Lance Terada, CTR <lance.terada.ctr(a)mhpcc.hpc.mil> a ?crit : > > Hi Shawn, > > Yes, I already enabled smart cards for login. So I guess I?m having another issue as I?ve set that option but my screensaver still doesn?t turn on after I pull my CAC. The read command returns correct information. > > Is there anything else I can check? Did you restart your computer since you?ve set this setting? Or at least killed the cfprefsd service ? Look at the syslog when you remove the smart card to see if the removal is correctly seen. > >> On Mar 22, 2016, at 6:47 PM, Shawn Geddis <geddis(a)icloud.com <mailto:geddis@icloud.com>> wrote: >> >> sudo /usr/libexec/plistbuddy -c "Add:tokenRemovalAction integer 1" /Users/<username>/Library/Preferences/com.apple.screensaver.plist >> sudo /usr/libexec/plistbuddy -c "Add:askForPassword integer 1" /Users/<username>/Library/Preferences/com.apple.screensaver.plist >> sudo /usr/libexec/plistbuddy -c "Add:askForPasswordDelay integer 0" /Users/<username>/Library/Preferences/com.apple.screensaver.plist >> >> >> You can also READ what the settings are using ?defaults': >> >> $ sudo defaults read /Users/<username>/Library/Preferences/com.apple.screensaver Don?t forget cfprefsd when editing plist files on disk. If you use defaults, cfprefsd is updated, but if you use anything else the caching service isn?t updated and your new settings never used.

3 2

Re: [SmartcardServices-Users] Differences between & fixes for the BelPic, Beid, CAC Tokend's
by Maccampus 28 Mar '16

28 Mar '16

Hello Mr Shawn Geddis & Readers of the Tokend & SmartcardServices Mailing Lists, I have found another link. Instead of looking for information in the source for the linux version which obviously won’t have source for the tokend which is OS X technology, you might have a look at folowing github page. https://github.com/Fedict/eid-mw On this page is an xcode project for the tokend. I think this could be very useful. Yours sincerely Maccampus Belgian Mac OS X User

1 0