From shawn at redhat.com Thu Aug 20 11:31:40 2015 Content-Type: multipart/mixed; boundary="===============6243378949455251765==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 2/3] Added guidance on use of CAC cards. Date: Wed, 18 Jul 2012 23:32:14 -0400 Message-ID: <50077FBE.20005@redhat.com> In-Reply-To: 1342632141-1723-3-git-send-email-wsantos@redhat.com --===============6243378949455251765== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 7/18/12 1:22 PM, Willy Santos wrote: > Signed-off-by: Willy Santos > --- > RHEL6/input/system/accounts/physical.xml | 37 +++++++++++++++++++++++= +++++++ > 1 files changed, 37 insertions(+), 0 deletions(-) > > diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/syste= m/accounts/physical.xml > index a8db13b..83cec03 100644 > --- a/RHEL6/input/system/accounts/physical.xml > +++ b/RHEL6/input/system/accounts/physical.xml > @@ -292,5 +292,42 @@ for users who may need to suspend console logins. > > > > + > + > +Using Smart Cards for System Login > + > +The use of Smart Cards, like Common Access Cards (CAC), for system login "... such as Common Access..." would be better > +provides stronger, two-factor authentication than using a username/passw= ord. > +Smart Cards take advantage of Public Key Infrastructure (PKI) to store > +encrypted digital certificates that can be used to authenticate the card > +owner. > +

> +In Red Hat Enterprise Linux servers and workstations, Smart Card login > +is not enabled by default and must be enabled in the system settings. > +Detailed procedures on how to configure a system to use Smart Card > +authentication for login can be found in the Red Hat Documentation web s= ite: > +
    > +
  • https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/M= anaging_Smart_Cards/enabling-smart-card-login.html
  • > +
I would end the patch here. We don't want to get caught up in = implementation details that are spelt out in other authoritative guides. An ending line stating "It is recommended to use Smart Cards wherever = feasible as part of a multifactor authentication system" would be = appropriate. > +The following packages are required in order to enable use of Smart Cards > +on RHEL: > +
    > +
  • nss-tools
  • > +
  • esc
  • > +
  • pam_pkcs11
  • > +
  • coolkey
  • > +
  • ccid
  • > +
  • gdm
  • > +
  • authconfig
  • > +
  • authconfig-gtk
  • > +
  • krb5-libs
  • > +
  • krb5-workstation
  • > +
  • krb5-auth-dialog
  • > +
  • krb5-pkinit-openssl
  • > +
> +
> + > +
> + > > --===============6243378949455251765==--