Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Safeguard Authentication Services 5.0 - Authentication Services for Smart Cards Administration Guide

Table of Contents

Privileged Access Suite for Unix

About this guide

Introducing Safeguard Authentication Services for Smart Cards

Features and benefits

Strong two-factor authentication for Unix Smart Card login integrated with Active Directory Integration with existing Unix applications

Supported platforms Supported cards and readers Safeguard Authentication Services for Smart Cards components

Plugin PAM module The vastool smartcard command line utility Vendor PKCS#11 drivers

Installing Safeguard Authentication Services for Smart Cards

Installing vendor smart card drivers

Logging in to Active Directory with your card

Installing Safeguard Authentication Services for Smart Cards software

Configuring Safeguard Authentication Services for Smart Cards

Configuring the vendor’s PKCS#11 library

Testing the PKCS#11 library for Safeguard Authentication Services for Smart Cards compatibility (optional) Configuring the vendor's PKCS#11 library using VASTOOL Configuring the vendor's PKCS#11 library by editing the configuration file Configuring the PKCS#11 library for 32-bit and 64-bit versions

Configuring the card slot for your PKCS#11 library

Configuring the card slot using VASTOOL Configuring the vendor's PKCS#11 slot by editing the configuration file

Configuring PAM applications for smart card login

Security issues when configuring smart card login Usability issues with PAM applications Enabling smart card login for selected services

Enabling smart card login Disabling smart card login

Configuring applications for smart card and password login Configuring applications for smart card login pam_vas_smartcard options Configure Gnome Display Manager (GDM)

Configuring GDM for smart card Disable remote login

Editing the GDM configuration file manually Editing the GDM configuration file with the graphical application

Using GDM with a smart card

Configure K Display Manager (KDM)

Configuring KDM for smart card Disabling remote login Using KDM with a smart card

Configure X Display Manager (XDM)

Configure XDM for smart card Disabling remote login

Configure console login

Configuring console login for smart card Disabling remote login Using console login with a smart card

Configuring certificates and CRLs

Public Key Infrastructure Certificates and CRLs

How Safeguard Authentication Services for Smart Cards uses certificates and CRLs Map certificate to user (implicit and explicit) Bootstrapping trusted certificates Automatic CRL retrieval Options for controlling certificate and CRL processing Managing Certificates and CRLs

Update certificates manually Force an update of certificates Disable bootstrap and manage certificates and CRLs manually

Locking the screen saver upon card removal (macOS)

Testing Safeguard Authentication Services for Smart Cards

Testing general configuration and login using smart card Testing the configuration

Test the PKCS#11 library Test the smart card is initialized correctly Test the smart card user Test user log in

Troubleshooting

Steps to diagnose problems

Check the smart card reader Check the PKCS#11 library Check the card Check login Enable debugging for smart card login with PAM Enable debugging for the Safeguard Authentication Services daemon Enable debugging for the PKCS#11 library

Troubleshooting vastool errors

vastool ERROR: no PKCS#11 library specified in vas.conf vastool ERROR: Could not get symbol 'C_GetFunctionList' vastool ERROR: invalid ELF header vastool ERROR: cannot open shared object file vastool ERROR: smart card is not present in slot vastool WARNING: "Smart card user X is not unix enabled" issue

Troubleshooting PAM or "vastool smartcard test login" errors

Login fails when the network connectivity is down Login fails when the system's internal clock is not synchronized Login fails when the user account is disabled Login fails when the user's certificate is not authorized Troubleshooting "KDC has no support for padata type" issue Troubleshooting "Cannot contact any KDC for requested realm" issue

Troubleshooting log errors

Log shows "clock skew problems" Log shows "server policy does not allow them on" or "account is expired" Log shows "Failed authentication attempt: cannot verify certificate"

Troubleshooting "Client not trusted" issue Troubleshooting certificate lookups

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center