- SmartcardServices-Users - lists.macosforge.org

CAC with OS X Yosemite
by William Guthrie (wiguthri) 02 Oct '15

02 Oct '15

I've downloaded and installed the latest tokenend for OS X Yosemite. Does anyone have any documentation on what configuration is required to get CAC login working on OS X Yosemite. I've been using an old document from Apple from 2006 but it is out of date in parts and I cannot find anything more recent. I want to be able to login to the machine with a CAC card and also to leverage that card for applications on the machine which support SAML SSO authentication. Thanks in advance for any assistance. Regards William,

1 0

Re: [SmartcardServices-Users] [SmartcardServices-Dev] Signed Installer posted for OS X El Capitan v10.11
by Shawn Geddis 01 Oct '15

01 Oct '15

On Oct 1, 2015, at 11:44 AM, Thomas Harning Jr. <harningt(a)gmail.com> wrote: > > Thanks. Is there any documentation available that shows where the new tokend installations should go? > > Does this installation location happen to work for older OSX versions, or is the location only scanned by OSX 10.11? If this location is only for newer versions of OSX, this complicates things for users that install an application on 10.10 or earlier and come to OSX 10.11 to discover their TokenD was obliterated. > > Smart card development for OSX seems to be a particularly dark art. By chance are there any samples of TokenD modules written using Apple's new blessed token API - the asynchronous nature of the new API seems to be in conflict with TokenD API specifications. Thomas, • The Installer Download Page, the Installer and the man page for SmartCardServices notes the new tokend installation path for OS X El Capitan v10.11. • The Path [/Library/Security/tokend/ ] is new for OS X El Capitan v10.11 and higher and is not supported on older versions of OS X v10.x. • Location of Tokend bundles does not affect use by Applications, since this is completely abstracted away. • There currently is no code samples or reference implementations for CryptoTokenKit Clients from Apple nor yet from the project here. • TokenD API specifications ? There never was any API specification to Apple’s knowledge. What reference are you making ? See man page for SmartCardServices…. $ man SmartCardServices SMARTCARDSERVICES(7) BSD Miscellaneous Information Manual SMARTCARDSERVICES(7) NAME SmartCardServices -- overview of smart card support DESCRIPTION SmartCardServices is a set of components which add native support for smart cards to OS X. Supported smart cards appear as separate keychains. A Tokend module for each smart card you wish to use must be installed in /Library/Security/tokend USB SMART CARD READER DRIVERS OS X has built-in support for USB CCID class-compliant smart card read- ers. For other readers, install the reader driver in /usr/local/libexec/SmartCardServices/drivers. Each driver is a bundle. The bundle contains an XML file Info.plist which contains the device's USB vendor ID and product ID. For detailed description of the plist for- mat and how to write a reader driver, see http://pcsclite.alioth.debian.org/api/group__IFDHandler.html SMART CARD APDU LOGGING It is possible to turn on logging for smart cards. Logging is turned on by setting the global preference: sudo defaults write /Library/Preferences/com.apple.security.smartcard Logging -bool yes After a smart card reader is connected (or after reboot) all operations including contents of sent and received APDU messages are then logged into the system log. Logging uses the facility com.apple.security.smart- card.log so it is possible to set up filtering of these logs into custom targets (see asl.conf(5)) To avoid security risks that could occur if logging is turned on indefi- nitely, the logging setting is one-shot - it must be turned on by the command above to start logging again with a new reader. This includes unplugging and replugging the same reader. SEE ALSO sc_auth(8), defaults(1), asl.conf(5), ssh-keychain(8) Mac OS X August 5, 2014 Mac OS X - Shawn _____________________________________________________________________ Shawn Geddis geddis@{Mac | Me | iCloud}.com Security and Certifications Engineer, Apple geddis(a)apple.com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0

Signed Installer posted for OS X El Capitan v10.11
by Shawn A. Geddis 01 Oct '15

01 Oct '15

Signed Installer posted for OS X El Capitan v10.11 <https://smartcardservices.macosforge.org/post/signed-installer-posted-for-o…>2015-10-01 Installer posted for OS X El Capitan v10.11. This SmartCardServices Installer provides the Tokend bundles and cacloginconfig.plist for installation on your OS X El Capitan systems. Starting with today's (1 Oct 2015) release of the installer for OS X El Capitan v10.11, we are digitally signing the Installer and Tokend bundles for integrity assurance. The installer will be recognized and install properly with Gatekeeper set to default or higher and, on El Capitan, are installed in a new location "/ Library / Security / tokend" to work with System Integrity Protection (SIP) enabled. ____________________________________________________________________________________ NOTE: Installer and Tokend bundles from this project are now digitally signed. Older installers (ie. for v10.10, v10.9, ...) will be re-posted, incremented to v2.1, and digitally signed. The installation location will remain as they were on the respective OS releases. ____________________________________________________________________________________ You should verify the integrity of the Tokend(s) you have installed by verifying the digital signature using the following command in Terminal: $ codesign -dvvvv /Library/Security/tokend/<nameoftoken>.tokend for example: $ codesign -dvvvv /Library/Security/tokend/PIV.tokend Your results should be similar to the following: $ codesign -dvvvv /Library/Security/tokend/PIV.tokend/ Executable=/Library/Security/tokend/PIV.tokend/Contents/MacOS/PIV Identifier=org.macosforge.smartcardservices.tokend.piv Format=bundle with Mach-O thin (x86_64) CodeDirectory v=20200 size=1307 flags=0x0(none) hashes=57+3 location=embedded Hash type=sha1 size=20 CDHash=9211409073a5f9034a523b891918cbf8030a6b84 Signature size=4349 Authority=Mac Developer: Shawn Geddis (6NSF8PH78P) Authority=Apple Worldwide Developer Relations Certification Authority Authority=Apple Root CA Signed Time=Sep 29, 2015, 9:06:58 PM Info.plist entries=9 TeamIdentifier=L2L8FX9AEK Sealed Resources version=2 rules=12 files=5 Internal requirements count=1 size=92 To ensure you have the original installer posted here and not one that has been modified, please also verify the SHA-256 hash of the .zip you download against the hash posted for the corresponding installer from the installers download page. http://smartcardservices.macosforge.org/trac/wiki/installers/ <https://smartcardservices.macosforge.org/trac/wiki/installers> Recall, we also post installers under a “Current” Static URL as well. SmartCard Services "Current" - Most recent Installer (i.e v2.1.0 for OS X El Capitan v10.11) http://smartcardservices.macosforge.org/files/installers/SCS-Current.zip <https://smartcardservices.macosforge.org/files/installers/SCS-Current.zip> The static URL for the most recent installer versions corresponding to each major release of OS X follows the format: http://smartcardservices.macosforge.org/files/installers/SCS-XX.YY-Current.… XX - 10 YY - Major Release (i.e '09' for OS X Mavericks v10.9) "Current - OS X El Capitan v10.11 <https://smartcardservices.macosforge.org/files/installers/SCS-10.11-Current…>” "Current - OS X Yosemite v10.10 <https://smartcardservices.macosforge.org/files/installers/SCS-10.10-Current…>” "Current - OS X Mavericks v10.9 <https://smartcardservices.macosforge.org/files/installers/SCS-10.09-Current…>” "Current - OS X Mountain Lion v10.8 <https://smartcardservices.macosforge.org/files/installers/SCS-10.08-Current…>” "Current - OS X Lion v10.7 <https://smartcardservices.macosforge.org/files/installers/SCS-10.07-Current…>” "Current - OS X Snow Leopard v10.6" <https://smartcardservices.macosforge.org/files/installers/SCS-10.06-Current…> - Shawn _____________________________________________________________________ Shawn Geddis geddis at {Mac | Me | iCloud} dot com Security and Certifications Engineer, Apple geddis at {apple} dot com Smart Card Services Project/Dev Lead: Project Wiki: [SmartCardServices.MacOSFforge.Org <http://smartcardservices.macosfforge.org/>] Mailing Lists: [Lists.MacOSForge.Org/mailman/listinfo <http://lists.macosforge.org/mailman/listinfo>] SCS Contact: [scs-cotact(a)macosforge.org <mailto:scs-cotact@macosforge.org>] SCS Admin: [scs-admin(a)macosforge.org <mailto:scs-admin@macosforge.org>] _____________________________________________________________________

1 0

OS X 10.11 and SmartCard Services
by Lamb, John (NIH/NCI) [C] 30 Sep '15

30 Sep '15

All, I am supporting a large install base of users (roughly 1000 users for 2000 computers) with: Identiv SCR3500 A Contact Reader Product ID: 0x5814 Vendor ID: 0x04e6 (Shuttle Technology) Version: 2.02 Which are nearly physically identical to SMC Microsystems SCx35xx v2.0 USB SC Reader Product ID: 0x5410 Vendor ID: 0x04e6 (Shuttle Technology) Version: 3.04 In OS X 10.7 -> OS X 10.10 the SCx35xx automatically works, the SCR3500 needs a “driver” ( http://support.identive-group.com/show_faq.php?f_kz=1065&lang=EN##) which adds a new bundle at /usr/libexec/SmartCardServices/Drivers/smccid.bundle [ “by works” I mean in /var/logsystem.log the OS will log the insertion/removal of a reader. Be assured that I am not troubleshooting card/user/certificate issues here. ] Alternatively, you can use the provided script in that FAQ article to modify the existing ifs-ccid.bundle. Therefore, as far as I understand it these are functionally identical, and the issue is properly identifying the card reader to the OS so drivers that already exist can do their job In order to be able to support upgrades to OS X 10.11, I will need to provide support for these card readers. Due to /usr/libexec being off limits to SIP, i see the following options: 1. When I create a new OS X 10.11 image, temporarily disable SIP during creation to place the drivers. Should I have a later “driver” conflict I will need to disable SIP to remove the smccid.bundle, which presents challenges at this scale. 2. Ask the developers of smartcardservices if a new release will support these card readers (and I have delayed close as I can to the release of OS X 10.11 so that I can say its “Sept 30th somewhere.” 3. Ask the developers if there is a better way to reference a non-SIP location for a driver (for instance, with 10.11 lacking pcscd (or at the very least, which pcscd coming up with nothing), is /etc/reader.conf still honored? In which case I simply need to identify the right CHANNELID and i can place the driver at /usr/local/pcsc/drivers/smccid.bundle) or a writeable location somewhere in /Library/ that smart card services already looks for drivers 4. File a bug report to Apple, asking for /usr/libexec/smartcardservices/drivers to be exempted from SIP (I am aware that this strays into unsupported territory and I will be correspondingly courteous and understanding.) I will be prepared for 1, and this email is asking politely for 2 or 3. I’ll pursue 4 if warranted. Thank you very much. John Lamb (Contractor) SRA International National Cancer Institute Center for Biomedical Informatics and Information Technology 9609 Medical Center Drive Rockville, MD 20850 lambje2(a)mail.nih.gov<http://lambje2@mail.nih.gov>

3 4

mixed success with two smart cards and SCR 335
by Kostantinos Koukopoulos 17 Sep '15

17 Sep '15

Hi all, I'm trying to use two different smartcards and having mixed success, using Mac OS X Yosemite. My reader is a SCM SCR 335 USB reader and the two cards I have tried are the OpenPGP card by g10 [1] and the Estonian ID card [2]. So far I have been able to use gnupg to decrypt a file using a key on the openpgp card, and I have also managed to configure Firefox and Chrome to see the certificate on the Estonian ID card. So, already this is considerable success and I thank you for the software you provide to make it possible. However not everything is going smoothly. For one, while I have the openpgp card in the reader I see these messages in the console: 9/17/15 10:46:58.268 AM com.apple.SecurityServer[80]: token in reader SCM Microsystems Inc. SCR 335 cannot be used (error 229) 9/17/15 10:46:58.537 AM com.apple.SecurityServer[80]: reader SCM Microsystems Inc. SCR 335: state changed 32 -> 290 9/17/15 10:47:00.947 AM com.apple.SecurityServer[80]: token in reader SCM Microsystems Inc. SCR 335 cannot be used (error 229) 9/17/15 10:47:00.949 AM com.apple.SecurityServer[80]: reader SCM Microsystems Inc. SCR 335: state changed 288 -> 34 9/17/15 10:47:01.197 AM com.apple.xpc.launchd[1]: (com.apple.ctkpcscd[11360]) Service exited due to signal: Killed: 9 These messages repeat endlessly until I remove the card. This does not happen with the estonian id, only with the openpgp card. Any idea what might be causing this message? Second, I tried to configure Mac OS X to allow logging in with the Estonian ID smartcard. I used the "sc_auth accept" command. I didn't see any error, however I was unable to test it because after a restart I realized that my smartcard's PIN was blocked. I don't have the PUK with me at the moment, but I will retry when I do. Does anybody have any tips as to what I should do? I'm afraid to try with my openpgp card in case the same thing happens. As for the software installed: I have installed Smartcard Services (v2.0.2) *and* I have installed the Estonian ID software (which I think installs Safesign, i.e. /usr/local/lib/libaetpkss.dylib). The first I did while trying to use my openpgp card, and the second while trying to use my estonian digital id card. Is there a possibility that they are somehow conflicting? Thank you, Konstantinos 1. http://www.g10code.com/p-card.html 2. http://id.ee/index.php?id=30470 -- |/ |/ Konstantinos <koukopoulos(a)gmail.com> |\ |\ Koukopoulos <http://kouk.surukle.me> VSRE messages are welcome*, Thanks! * for more information see: http://vsre.info <http://vsre.info/>

1 0

Pkinit working on MacOSX 10.9.5 or 10.10?
by Glenn Machin 31 Aug '15

31 Aug '15

The only way I can see a Kerberos AS_REQ using PKINIT is using the command line "kinit -C KEYCHAIN:". Has anyone got PKINIT working via OpenDirectory during login or via pam modules (pam_opendirectory or pam_krb5)? Shame I don't see Apple publishing documents describing how to enable pkinit given federal government requirements for use of smartcards. Seems like its the users helping users, while Apple keeps quiet. Appreciate any help. Glenn

3 6

Re: [SmartcardServices-Users] [EXTERNAL] Re: Pkinit working on MacOSX 10.9.5 or 10.10?
by Glenn Machin 31 Aug '15

31 Aug '15

Shame Apple won't enable the use of : pkinit_identities = PKCS11:Path_of_pkcs11_lib for their Heimdahl Kerberos implementation. If they did the then the pam_krb5 module could be added to /etc/pam.d/sudo. I believe Heimdahl Kerberos supports it. I know the MIT Kerberos does. Thanks for the information. Glenn On 8/31/15 6:53 AM, Carib Mendez wrote: > . >> We are also going to get the non-express version of Centrify to see if that enables pkinit with PIV for login and screenlock, I will let this email list know what I find. >> > We use the full centrify in our environment. I can attest to it's ability for full CAC login, PKINIT and screenlock. It also include a pkcs11 module for apps that don't use regular system keychain calls (Firefox primarily). THe only thing it does not include is the ability to use your CAC at the command line with sudo. I believe thursby has a special sudo that will authenticate with the CAC, but centrify unfortunately does not. Their solution is to add admin groups to the sudoers file so they don't have to enter a password for sudo. > > >> Thanks for the response, >> >> >> >> Glenn >> >> >> >> >> On 8/31/15 2:04 AM, Yoann Gini wrote: >>>> Le 29 août 2015 à 23:30, Glenn Machin <gmachin(a)sandia.gov> a écrit : >>>> >>>> The only way I can see a Kerberos AS_REQ using PKINIT is using the command line "kinit -C KEYCHAIN: ». >>> Same behaviors here. I’m not able to use standard system in PKINIT system. >>> >>>> Has anyone got PKINIT working via OpenDirectory during login or via pam modules (pam_opendirectory or pam_krb5)? >>>> >>>> Shame I don't see Apple publishing documents describing how to enable pkinit given federal government requirements for use of smartcards. >>>> Seems like its the users helping users, while Apple keeps quiet. >>> The only advice I can tell is to use Centrify Express. It’s free, it works, and it will be quick for you. >>> >>> Best regards, >>> Yoann Gini >>> >> _______________________________________________ >> SmartcardServices-Users mailing list >> SmartcardServices-Users(a)lists.macosforge.org >> https://lists.macosforge.org/mailman/listinfo/smartcardservices-users

1 0

Yosemite SmartCard Services and Local and or Open Directory Accounts
by Schwartz, Jared 30 Aug '15

30 Aug '15

Hello All, I have made great progress with the Smart Card services tool and our PIV cards. I was able to login to web portals with no issues but I have hit a roadblock and was hoping you could help. We have our machines connected to an open directory, and would like to login to the account via PIV cards. As a test I used sudo sc_auth accept -u administrator -k "PIV" and or $ sudo sc_auth accept -u Alice -h HASH to bind the certificates hash to the local administrator account. I verified the hash is set under the local administrator account and then logged out but I never get the "switchover" from password login to PIN on Mac OS 10.10.5. I also tried on a machine that is not connected to the open directory with the same result. After we get past the issue of it not being able login with the PIN, any idea how we setup the hash attribute for our users in open directory? Thanks in advance, Jared

2 1

Re: [SmartcardServices-Users] PKCS11 library availability
by Disiena, Ridley (MSFC-IS60)[EAST] 25 Aug '15

25 Aug '15

To answer non-athoritatively, it has never shipped with the Smart Card Services installer from Mac OS Forge. It was included in 10.6 and 10.7 and shipped in the OS as part of the Golden Master. The source may be found here: http://smartcardservices.macosforge.org/trac/browser/trunk/TokendPKCS11 It is unclear why they stopped providing it, it does work for auth/signing and decryption, even on the latest versions of the operating system. To use it. one could track down the older binary or build from source as needed. -Ridley From: <smartcardservices-users-bounces(a)lists.macosforge.org<mailto:smartcardservices-users-bounces@lists.macosforge.org>> on behalf of "Alekseyev, Vsevolod (NIH/NIAID) [E]" <VAlekseyev(a)niaid.nih.gov<mailto:VAlekseyev@niaid.nih.gov>> Date: Thursday, August 20, 2015 at 4:05 PM To: "SmartcardServices-Users(a)lists.macosforge.org<mailto:SmartcardServices-Users@lists.macosforge.org>" <SmartcardServices-Users(a)lists.macosforge.org<mailto:SmartcardServices-Users@lists.macosforge.org>> Cc: "Cobbs, Ronald (NIH/NIAID) [C]" <ronald.cobbs(a)nih.gov<mailto:ronald.cobbs@nih.gov>> Subject: [SmartcardServices-Users] PKCS11 library availability Hi everyone, Is the PKCS11 over TokenD library shipped with Smart Card Services for MacOS 10.9-10.10, please? The wiki page does mention it under http://smartcardservices.macosforge.org/trac/wiki/tokend and under http://smartcardservices.macosforge.org/trac/wiki/scs , but I couldn’t find it neither on the system (after installing from http://smartcardservices.macosforge.org/trac/wiki/installers ), nor in the package itself. Regards, Seva Alekseyev

2 3

PKCS11 library availability
by Alekseyev, Vsevolod (NIH/NIAID) [E] 20 Aug '15

20 Aug '15

Hi everyone, Is the PKCS11 over TokenD library shipped with Smart Card Services for MacOS 10.9-10.10, please? The wiki page does mention it under http://smartcardservices.macosforge.org/trac/wiki/tokend and under http://smartcardservices.macosforge.org/trac/wiki/scs , but I couldn't find it neither on the system (after installing from http://smartcardservices.macosforge.org/trac/wiki/installers ), nor in the package itself. Regards, Seva Alekseyev

1 0