RE: [SmartcardServices-Users] [Fed-Talk] Re: Require smart card login
RE: [SmartcardServices-Users] [Fed-Talk] Re: Require smart card login
- Subject: RE: [SmartcardServices-Users] [Fed-Talk] Re: Require smart card login
- From: "Miller, Timothy J." <email@hidden>
- Date: Thu, 14 Oct 2010 10:03:51 -0400
- Acceptlanguage: en-US
- Thread-topic: [SmartcardServices-Users] [Fed-Talk] Re: Require smart card login
For local logon, use pam-pkcs11 from the OpenSC project:
http://www.opensc-project.org/pam_pkcs11/
Plus the OpenSC PKCS#11 module:
http://www.opensc-project.org/opensc/wiki/PKCS11
Plus, of course, OpenSC itself for the PIV support.
This will work with most PAM-enabled applications, including sudo. gksu/gksudo (which are basically GUI wrappers around sudo) had a bug where they wouldn't recognize the changed 'password' prompt, but this may be fixed in current releases.
If you're looking for PKINIT with Linux, use Russ Allbery's pam_krb5 module with a recent Heimdal or MIT Kerberos library. Configuration details depend on the version of Windows Server you're using, but are all online.
-- Tim
________________________________________
From: email@hidden [email@hidden] On Behalf Of Inati, Souheil (NIH/NIMH) [E] [email@hidden]
Sent: Wednesday, October 13, 2010 5:26 PM
To: Bram Cymet
Cc: Shawn A. Geddis; Fed Talk; Inati, Souheil (NIH/NIMH) [E]; Smart Card Services-Users
Subject: Re: [SmartcardServices-Users] [Fed-Talk] Re: Require smart card login
Hi Bram,
In our group, the workstations are split about 60/40 OS X/Linux based on user preference. Nearly all the laptops are macs. None of the scientists use windows unless they have to for specialized data acquisition systems.
Like I said, heterogeneous :-)
BTW, we'll have to burn the Linux bridge too, could you point me to how you would require PIV login on the Linux machines?
-Souheil
On Oct 13, 2010, at 5:57 PM, Bram Cymet wrote:
> Is OS X a requirement? This can very easily be done on Linux.
>
> On 10/13/2010 05:42 PM, Inati, Souheil (NIH/NIMH) [E] wrote:
>> Sorry, not an option. We have terabytes of data on disks in a heterogeneous environment.
>>
>> On Oct 13, 2010, at 5:37 PM, Bram Cymet wrote:
>>
>>> If it is the data you are looking to protect you can put it in a
>>> filevault and protect the filevault with your smartcard. This is very
>>> easy to do. I have yet to find a way to lock access to the machine to
>>> smartcard only. Then as long as the vault is not left open when the
>>> machine in unattended you will be fine.
>
>
> --
> Bram Cymet
> Software Developer
> Canadian Bank Note Co. Ltd.
> Cell: 613-608-9752
>
>
_______________________________________________
SmartcardServices-Users mailing list
email@hidden
http://lists.macosforge.org/mailman/listinfo.cgi/smartcardservices-users _______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden