On 7/18/12 1:22 PM, Willy Santos wrote:
Signed-off-by: Willy Santos <wsantos(a)redhat.com>
---
RHEL6/input/system/accounts/physical.xml | 37 ++++++++++++++++++++++++++++++
1 files changed, 37 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/system/accounts/physical.xml
b/RHEL6/input/system/accounts/physical.xml
index a8db13b..83cec03 100644
--- a/RHEL6/input/system/accounts/physical.xml
+++ b/RHEL6/input/system/accounts/physical.xml
@@ -292,5 +292,42 @@ for users who may need to suspend console logins.
<ref nist="CM-6, CM-7" disa="56,58" />
</Rule>
</Group>
+
+<Group id="smart_card_login">
+<title>Using Smart Cards for System Login</title>
+<description>
+The use of Smart Cards, like Common Access Cards (CAC), for system login
"...
such as Common Access..." would be better
+provides stronger, two-factor authentication than using a
username/password.
+Smart Cards take advantage of Public Key Infrastructure (PKI) to store
+encrypted digital certificates that can be used to authenticate the card
+owner.
+<br /><br />
+In Red Hat Enterprise Linux servers and workstations, Smart Card login
+is not enabled by default and must be enabled in the system settings.
+Detailed procedures on how to configure a system to use Smart Card
+authentication for login can be found in the Red Hat Documentation web site:
+<ul>
+<li>https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html</li>
+</ul>
I would end the patch here. We don't want to get caught up in
implementation details that are spelt out in other authoritative guides.
An ending line stating "It is recommended to use Smart Cards wherever
feasible as part of a multifactor authentication system" would be
appropriate.
+The following packages are required in order to enable use of Smart
Cards
+on RHEL:
+<ul>
+<li>nss-tools</li>
+<li>esc</li>
+<li>pam_pkcs11</li>
+<li>coolkey</li>
+<li>ccid</li>
+<li>gdm</li>
+<li>authconfig</li>
+<li>authconfig-gtk</li>
+<li>krb5-libs</li>
+<li>krb5-workstation</li>
+<li>krb5-auth-dialog</li>
+<li>krb5-pkinit-openssl</li>
+</ul>
+</description>
+<ref disa="" />
+</Group>
+
</Group>
</Group>