Common Access Card

From ArchWiki
Jump to: navigation, search

Tango-view-fullscreen.pngThis article or section needs expansion.Tango-view-fullscreen.png

Reason: A short general article about Smartcards (or Smartcard readers) is lacking. This article could become the foundation for it; the CAC relevant/specific content being moved to a section. Further related pcsc-tools exist (and contain supportability information), which can be helpful for identifying other smartcards.[1] (Discuss in Talk:Common Access Card#)

This page explains how to setup Arch to use a US Department of Defense Common Access Card (CAC).

Installation

Install ccid and opensc from official repositories.

Configuration

Note: You should not have to edit your opensc configuration files by default. You should check all other setup items first (e.g. certificate imports)

If your card reader does not have a pin pad, uncomment enable_pinpad = false in /etc/opensc.conf.

Sometimes opensc can struggle to identify the proper driver for CAC, instead it may choose PIV or something else. You can force the CAC driver by editing /etc/opensc.conf for card_drivers = cac and force_card_driver = cac

Enable pcscd

Start and enable pcscd.socket.

Configure browser

1. Go to: http://iase.disa.mil/pki-pke/Pages/tools.aspx

2. Download certs: "Trust Store" -> "PKI CA Certificate Bundles: PKCS#7" -> "For DoD PKI Only - Version 5.3" (ZIP Download)

3. Unzip the DoD PKI zip

4. Follow browser-specific instructions

Firefox

Load security device

Navigate to Edit -> Preference -> Advanced -> Certificates -> Security Devices and click "Load" to load a module using /usr/lib/opensc-pkcs11.so or /usr/lib/pkcs11/opensc-pkcs11.so.

Note: Firefox may report the module did not load correctly however you will have to check in the security devices to confirm whether the module properly loaded or not

Import the DoD Certificates

Install the certificates from the mentioned zip in _this_ order, by going to Edit -> Preference -> Advanced -> Certificates -> View Certificates -> Authorities -> Import (make sure to at-least check the box for "Trust this CA to identify websites"):

Note: As of the 5.3 version of the certificate zip

1. Certificates_PKCS7_v5.3_DoD.der.p7b

2. Certificates_PKCS7_v5.3_DoD_DoD_Root_CA_2.der.p7b

3. Certificates_PKCS7_v5.3_DoD_DoD_Root_CA_3.der.p7b

4. Certificates_PKCS7_v5.3_DoD_DoD_Root_CA_4.der.p7b

5. Certificates_PKCS7_v5.3_DoD_DoD_Root_CA_5.der.p7b

6. Certificates_PKCS7_v5.3_DoD.pem.p7b

Chromium/Google Chrome

1. Ensure CAC is connected, Chromium is closed and enter the following in a terminal: $ modutil -dbdir sql:.pki/nssdb/ -add "CAC Module" -libfile /usr/lib/opensc-pkcs11.so

Note: You may see the message 'Failure to load dynamic library'. This can be ignored.

2. Navigate (in a shell) to the location of the unzip DoD PKI files and install via:

 for n in $(ls * | grep Chrome); do certutil -d sql:$HOME/.pki/nssdb -A -t TC -n $n -i $n; done

Testing

Visit your favorite CAC secured web page and you should be asked for the Master Password for your certificate. Enter it and if you get in, you know it's working.

If some sites/pages seem to have a problem working correctly (e.g. outlook web access won't authenticate the session for DoD webmail) try using a private/incognito session to test validity of the cert chain and remove some variables.

Debugging

opensc-tool

Most of this information was found in a blog post by Firas Kraïem

Verify opensc can see your reader

$ opensc-tool --list-readers 
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes            Generic USB2.0-CRW [Smart Card Reader Interface] (20070818000000000) 00 00

List plugged in card

$ opensc-tool --reader 0 --name 
Personal Identity Verification Card

List plugged in card and drive in use

$ opensc-tool --reader 0 --name -v
Connecting to card in reader Generic USB2.0-CRW [Smart Card Reader Interface] (20070818000000000) 00 00...
Using card driver Personal Identity Verification Card.
Card name: Personal Identity Verification Card

pcsc-tools

The pcsc-tools package is also availabe in [community]. The program pcsc_scan may be helpful

[cceleri@ender ~]$ pcsc_scan 
PC/SC device scanner
V 1.4.21 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau@free.fr>
Compiled with PC/SC lite version: 1.8.6
Using reader plug'n play mechanism
Scanning present readers...
0: Dell Dell Smart Card Reader Keyboard 00 00

Thu Sep  5 10:41:53 2013
Reader 0: Dell Dell Smart Card Reader Keyboard 00 00
  Card state: Card removed, 

Thu Sep  5 10:41:58 2013
Reader 0: Dell Dell Smart Card Reader Keyboard 00 00
  Card state: Card inserted, 
  ATR: 3B DB 96 00 80 1F 03 00 31 C0 64 B0 F3 10 00 07 90 00 80

ATR: 3B DB 96 00 80 1F 03 00 31 C0 64 B0 F3 10 00 07 90 00 80
+ TS = 3B --> Direct Convention
+ T0 = DB, Y(1): 1101, K: 11 (historical bytes)
  TA(1) = 96 --> Fi=512, Di=32, 16 cycles/ETU
    250000 bits/s at 4 MHz, fMax for Fi = 5 MHz => 312500 bits/s
  TC(1) = 00 --> Extra guard time: 0
  TD(1) = 80 --> Y(i+1) = 1000, Protocol T = 0 
-----
  TD(2) = 1F --> Y(i+1) = 0001, Protocol T = 15 - Global interface bytes following 
-----
  TA(3) = 03 --> Clock stop: not supported - Class accepted by the card: (3G) A 5V B 3V 
+ Historical bytes: 00 31 C0 64 B0 F3 10 00 07 90 00
  Category indicator byte: 00 (compact TLV data object)
    Tag: 3, len: 1 (card service data byte)
      Card service data byte: C0
        - Application selection: by full DF name
        - Application selection: by partial DF name
        - EF.DIR and EF.ATR access services: by GET RECORD(s) command
        - Card with MF
    Tag: 6, len: 4 (pre-issuing data)
     Data: B0 F3 10 00
    Mandatory status indicator (3 last bytes)
      LCS (life card cycle): 07 (Operational state (activated))
      SW: 9000 (Normal processing.)
+ TCK = 80 (correct checksum)

Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
3B DB 96 00 80 1F 03 00 31 C0 64 B0 F3 10 00 07 90 00 80
	DoD CAC, Oberthur ID One 128 v5.5 Dual

See also