Tchater maintenant avec le support

Obtenir une aide instantanée
Terminer l’enregistrement

Se connecter

Demander les tarifs

Contacter le service des ventes

Safeguard Authentication Services 6.0 LTS - Authentication Services for Smart Cards Administration Guide

Parcourir le contenu

Privileged Access Suite for UNIX

About this guide

Introducing Safeguard Authentication Services for Smart Cards

Features and benefits

Strong two-factor authentication for UNIX Smart Card login integrated with Active Directory Integration with existing UNIX applications

Supported platforms Supported cards and readers Safeguard Authentication Services for Smart Cards components

Plugin PAM module The vastool smartcard command line utility Vendor PKCS#11 drivers

Installing Safeguard Authentication Services for Smart Cards

Installing vendor smart card drivers

Logging in to Active Directory with your card

Installing Safeguard Authentication Services for Smart Cards software

Configuring Safeguard Authentication Services for Smart Cards

Configuring the vendor’s PKCS#11 library

Testing the PKCS#11 library for Safeguard Authentication Services for Smart Cards compatibility (optional) Configuring the vendor's PKCS#11 library using VASTOOL Configuring the vendor's PKCS#11 library by editing the configuration file Configuring the PKCS#11 library for 32-bit and 64-bit versions

Configuring the card slot for your PKCS#11 library

Configuring the card slot using vastool Configuring the vendor's PKCS#11 slot by editing the configuration file

Configuring PAM applications for smart card login

Security issues when configuring smart card login Usability issues with PAM applications Enabling smart card login for selected services

Enabling smart card login Disabling smart card login

Configuring applications for smart card and password login Configuring applications for smart card login pam_vas_smartcard options Configuring Gnome Display Manager (GDM)

Configuring GDM for smart card Disabling remote login

Editing the GDM configuration file manually Editing the GDM configuration file with the graphical application

Using GDM with a smart card

Configuring K Display Manager (KDM)

Configuring KDM for smart card Disabling remote login Using KDM with a smart card

Configuring X Display Manager (XDM)

Configuring XDM for smart card Disabling remote login

Configuring console login

Configuring console login for smart card Disabling remote login Using console login with a smart card

Configuring certificates and CRLs

Public Key Infrastructure Certificates and CRLs

How Safeguard Authentication Services for Smart Cards uses certificates and CRLs Map certificate to user (implicit and explicit) Bootstrapping trusted certificates Automatic CRL retrieval Options for controlling certificate and CRL processing Managing Certificates and CRLs

Update certificates manually Force an update of certificates Disable bootstrap and manage certificates and CRLs manually

Locking the screen saver upon card removal (macOS)

Testing Safeguard Authentication Services for Smart Cards

Testing general configuration and login using smart card Testing the configuration

Test the PKCS#11 library Test the smart card is initialized correctly Test the smart card user Test user log in

Troubleshooting

Steps to diagnose problems

Checking the smart card reader Checking the PKCS#11 library Checking the card Checking login Enabling debugging for smart card login with PAM Enabling debugging for the Safeguard Authentication Services daemon Enabling debugging for the PKCS#11 library

Troubleshooting vastool errors

vastool ERROR: no PKCS#11 library specified in vas.conf vastool ERROR: Could not get symbol 'C_GetFunctionList' vastool ERROR: invalid ELF header vastool ERROR: cannot open shared object file vastool ERROR: smart card is not present in slot vastool WARNING: "Smart card user X is not unix enabled" issue

Troubleshooting PAM or "vastool smartcard test login" errors

Login fails when the network connectivity is down Login fails when the system's internal clock is not synchronized Login fails when the user account is disabled Login fails when the user's certificate is not authorized Troubleshooting "KDC has no support for padata type" issue Troubleshooting "Cannot contact any KDC for requested realm" issue

Troubleshooting log errors

Log shows "clock skew problems" Log shows "server policy does not allow them on" or "account is expired" Log shows "Failed authentication attempt: cannot verify certificate"

Troubleshooting "Client not trusted" issue Troubleshooting certificate lookups

vastool ERROR: no PKCS#11 library specified in vas.conf

Troubleshooting > Troubleshooting vastool errors > vastool ERROR: no PKCS#11 library specified in vas.conf

You encounter this error when you have not configured a PKCS#11 library.

To configure the PKCS#11 library, run the vastool smartcard configure pkcs11 lib command.

vastool ERROR: Could not get symbol 'C_GetFunctionList'

Troubleshooting > Troubleshooting vastool errors > vastool ERROR: Could not get symbol 'C_GetFunctionList'

You encounter this error when you have configured an invalid PKCS#11 library.

To determine that the PKCS#11 library is installed and configured, run the vastool smartcard info config command.

To test whether the configured library is valid, run the vastool smartcard test library command.

vastool ERROR: invalid ELF header

Troubleshooting > Troubleshooting vastool errors > vastool ERROR: invalid ELF header

You encounter this error when the configured PKCS#11 library is not a valid shared object.

To determine that the PKCS#11 library is installed and configured, run the vastool smartcard info config command.

To test whether the configured library is valid, run the vastool smartcard test library command.

vastool ERROR: cannot open shared object file

Troubleshooting > Troubleshooting vastool errors > vastool ERROR: cannot open shared object file

You encounter this error when the configured PKCS#11 library does not exist.

To determine that the PKCS#11 library is installed and configured, run the vastool smartcard info config command.

To test whether the configured library is valid, run the vastool smartcard test library command.

Documents connexes

The document was helpful.

Sélectionner une évaluation

I easily found the information I needed.

Sélectionner une évaluation

© ALL RIGHTS RESERVED. Conditions d’utilisation Confidentialité Cookie Preference Center