- SmartcardServices-Users - lists.macosforge.org

Activate screensaver with token
by Lance Terada, CTR 24 Mar '16

24 Mar '16

Hello, Does anyone know how to configure activating the screensaver after pulling your token out of the CAC reader? Thanks, Lance

4 6

Re: [SmartcardServices-Users] [Non-DoD Source] SmartcardServices-Users Digest, Vol 68, Issue 1
by Daly, John L CIV NAVAIR, 4G0000D 23 Mar '16

23 Mar '16

Hi Shawn, I have a long standing bug in the OS where I can't unlock the Security & Privacy Pane if my CAC is inserted in the machine. It asks for the PIN and the graphic shows it unlocking like it's supposed to, but then it immediately locks up again. This makes it impossible to get to the Advanced tab. I do use the command line to set tokenRemovalAction to 1, as you stated below, and it works flawlessly on my network accounts, but on Mobile accounts, despite the setting being correct, it will lock the screen when the token is removed, but when going to unlock it, it wants the password and not the PIN. I even verified this by creating an account and logging in to a client machine without letting it create the home directory on the client machine. Everything worked as it should. CAC removal caused the screen to lock, and the CAC PIN could unlock the screen. Logged out and back in, letting it create the home directory on the client machine, and then the CAC could no longer unlock the screen saver. What happened? Apple has gone from having the best out of the box smart card support in the industry to what is being called the worst on "howto" websites. Thank you, John __________________________________________ Message: 2 Date: Tue, 22 Mar 2016 21:47:02 -0700 From: Shawn Geddis <geddis(a)icloud.com> To: "Lance Terada, CTR" <lance.terada.ctr(a)mhpcc.hpc.mil> Cc: SmartCard Services-Users <smartcardservices-users(a)lists.macosforge.org> Subject: Re: [SmartcardServices-Users] Activate screensaver with token Message-ID: <F20B3017-984D-4DD3-B8C4-024A840ECE5B(a)icloud.com> Content-Type: text/plain; charset="utf-8" > On Mar 22, 2016, at 6:09 PM, Lance Terada, CTR <lance.terada.ctr(a)mhpcc.hpc.mil> wrote: > Hello, > Does anyone know how to configure activating the screensaver after pulling your token out of the CAC reader? Lance, If you already have enabled use of smartcards for login, you can simply click on on the ?Advanced?? tab at the lower right-hand corner. System Preferences -> Security & Privacy -> Advanced? This could be scripted with the following commands (Replace <username> with the actual account name): (This ends up being the easiest syntax for many) sudo /usr/libexec/plistbuddy -c "Add:tokenRemovalAction integer 1" /Users/<username>/Library/Preferences/com.apple.screensaver.plist sudo /usr/libexec/plistbuddy -c "Add:askForPassword integer 1" /Users/<username>/Library/Preferences/com.apple.screensaver.plist sudo /usr/libexec/plistbuddy -c "Add:askForPasswordDelay integer 0" /Users/<username>/Library/Preferences/com.apple.screensaver.plist You can also READ what the settings are using ?defaults': $ sudo defaults read /Users/<username>/Library/Preferences/com.apple.screensaver Which would give you the following: { askForPassword = 1; askForPasswordDelay = 0; tokenRemovalAction = 1; } - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Security and Certifications Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0

Reverting screen saver password dialog
by Andrew Richardson 27 Feb '16

27 Feb '16

Hi. I installed v2.1.2 on my Mac, but found that it doesn't work with my PIV card in my employer's infrastructure. I've removed the tokend subdirectories to uninstall the service, but my screen saver password dialog remains the old-style username/password style that it changed to when I installed. I've looked through the sources files, searching for a script that makes the style change to no avail. I don't know what I'm looking for. Can someone point me to an editable plist file, or a command line to change the style value for this dialog? I prefer the "normal" OS X style. I'm running OS X 10.11.3. Andrew My iPhone no longer looks like Han Solo's blaster. It looks like I'm living in the future.

1 0

Re: [SmartcardServices-Users] Submitting patches for PIVToken.cpp bugs [Yubikey Neo]
by david.lloyd＠fsmail.net 21 Jan '16

21 Jan '16

Hi, Just a quick status report to say that the the Yubico PIV tool now has a set-ccc command (along with the existing set-chuid command) so that Smartcard Services will work with the Yubikey NEO and 4. See https://github.com/Yubico/yubico-piv-tool There is no need to modify tokend. Thanks, David L > It would be nice if SmartCardServices tokend could work with a card that doesn't have a CCC object in it. > > In my experience, NEO (a) does not have CCC, and (b) does not perform SELECT command properly. > > One workaround I found for another tokend to work with NEO correctly was to generate a CCC object and write it to NEO using piv-tool from OpenSC package. > >

1 0

Re: [SmartcardServices-Users] SmartcardServices-Users Digest, Vol 66, Issue 2
by liuddd 20 Jan '16

20 Jan '16

Hi ! I followed the " pcscd debug output on Mac OS X " instructions, but when I plug in my USB reader, there is no other log output. It looks like that only CCID USB device is supported on my MacOSX 10.8 , Is the pcscd version(which is 1.4.0) too low? 在 2016-01-18 16:04:28，"Ludovic Rousseau" <ludovic.rousseau(a)gmail.com> 写道： Hello, 2016-01-18 4:12 GMT+01:00 liuddd <liudy75(a)163.com>: Hello! On my MacOSX10.8 system, I put one USB smart card reader(not of CCID class) driver in /usr/libexec/SmartCardServices/drivers, but the pcscd didn't start after I plug the reader in, any other steps should I take to get my driver running? Read " pcscd debug output on Mac OS X " http://ludovicrousseau.blogspot.com/2011/07/pcscd-debug-output-on-mac-os-x.… Bye -- Dr. Ludovic Rousseau

2 1

Yubico Yubikey
by Jorgensen, Will A 18 Jan '16

18 Jan '16

I was looking for different small form factor smart cards (basically something that could be left in the USB port without fear of it being broken) and I came accross the YubiKey Nano. Has anyone had experience with this company or its products? Also, anyone have suggestions for other small form factor devices such as this? __________________________________________________ Will Jorgensen IT Engineer Finance and Project Management Communications & IT I want to hear your feedback

2 1

Re: [SmartcardServices-Users] SmartcardServices-Users Digest, Vol 66, Issue 2
by liuddd 18 Jan '16

18 Jan '16

Hello! On my MacOSX10.8 system, I put one USB smart card reader(not of CCID class) driver in /usr/libexec/SmartCardServices/drivers, but the pcscd didn't start after I plug the reader in, any other steps should I take to get my driver running? At 2016-01-16 04:00:02, smartcardservices-users-request(a)lists.macosforge.org wrote: >Send SmartcardServices-Users mailing list submissions to > smartcardservices-users(a)lists.macosforge.org > >To subscribe or unsubscribe via the World Wide Web, visit > https://lists.macosforge.org/mailman/listinfo/smartcardservices-users >or, via email, send a message with subject or body 'help' to > smartcardservices-users-request(a)lists.macosforge.org > >You can reach the person managing the list at > smartcardservices-users-owner(a)lists.macosforge.org > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of SmartcardServices-Users digest..." > > >Today's Topics: > > 1. Re: Will a reader driver other than ifd-ccid.bundle for > MacOX10.9 work (liuddd) > 2. Re: Will a reader driver other than ifd-ccid.bundle for > MacOX10.9 work (Ludovic Rousseau) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Fri, 15 Jan 2016 14:50:11 +0800 (CST) >From: liuddd <liudy75(a)163.com> >To: "Ludovic Rousseau" <ludovic.rousseau(a)gmail.com> >Cc: smartcardservices-users(a)lists.macosforge.org >Subject: Re: [SmartcardServices-Users] Will a reader driver other than > ifd-ccid.bundle for MacOX10.9 work >Message-ID: <71747906.abf2.152440c6d7e.Coremail.liudy75(a)163.com> >Content-Type: text/plain; charset="gbk" > >Hello! > Thank you very much! I have another question, can I write a reader driver for non-CCID smartcard reader for MacOX10.9 or MacOX10.8? > I tried, but doesn't work, Is it possible? > > > > > > >? 2016-01-14 18:18:54?"Ludovic Rousseau" <ludovic.rousseau(a)gmail.com> ??? > >Hello, > > > >2016-01-14 10:15 GMT+01:00 liuddd <liudy75(a)163.com>: > > >hello? > We know that we can write a pcsc reader driver on MacOSX10.10 and higher system. Can I write one for MacOSX10.9 and MacOSX10.8?I write one and put in /usr/local/libexec/SmartCardServices/drivers but it doesn't work. Is it possible to write a customer reader driver ? Thank you > > > > >Put your driver in /usr/libexec/SmartCardServices/drivers/ without the "local" part. > > >Bye > > >-- > > Dr. Ludovic Rousseau >

2 1

Will a reader driver other than ifd-ccid.bundle for MacOX10.9 work
by liuddd 15 Jan '16

15 Jan '16

hello！ We know that we can write a pcsc reader driver on MacOSX10.10 and higher system. Can I write one for MacOSX10.9 and MacOSX10.8，I write one and put in /usr/local/libexec/SmartCardServices/drivers but it doesn't work. Is it possible to write a customer reader driver ? Thank you

2 3

Re: [SmartcardServices-Users] Will not work after upgrading OS to El Cpaitan
by Butch McCarty 09 Dec '15

09 Dec '15

Hello again Shawn, I reloaded my OS, tried every CAC program on militarycac.com, went through every blog I could find and I am still not able to get onto any DoD sites, since I upgraded to El Capitan. You requested logging information, and I would love to get that to you, but I am not sure which log file you would like.

1 0

Will not work after upgrading OS to El Cpaitan
by Butch McCarty 03 Dec '15

03 Dec '15

Hello sir or ma'am, I recently upgraded from Yosemite v10.10 to El Capitan v10.11. As soon as the upgrade was complete, I downloaded the new v2.1.2 installer, ran it successfully, but after I attempt to get onto my.af.mil, I get the "CAC error" screen. This doesn't happen on my other computers and I have swapped out the card readers, which all work on other computers. Is there any fix to El Capitan? -- V/r, Butch McCarty

2 1