[PATCH 2/3] Added guidance on use of CAC cards.

Shawn Wells shawn at redhat.com
Thu Jul 19 03:32:14 UTC 2012


On 7/18/12 1:22 PM, Willy Santos wrote:
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   RHEL6/input/system/accounts/physical.xml |   37 ++++++++++++++++++++++++++++++
>   1 files changed, 37 insertions(+), 0 deletions(-)
>
> diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml
> index a8db13b..83cec03 100644
> --- a/RHEL6/input/system/accounts/physical.xml
> +++ b/RHEL6/input/system/accounts/physical.xml
> @@ -292,5 +292,42 @@ for users who may need to suspend console logins.
>   <ref nist="CM-6, CM-7" disa="56,58" />
>   </Rule>
>   </Group>
> +
> +<Group id="smart_card_login">
> +<title>Using Smart Cards for System Login</title>
> +<description>
> +The use of Smart Cards, like Common Access Cards (CAC), for system login
"... such as Common Access..." would be better

> +provides stronger, two-factor authentication than using a username/password.
> +Smart Cards take advantage of Public Key Infrastructure (PKI) to store
> +encrypted digital certificates that can be used to authenticate the card
> +owner.
> +<br /><br />
> +In Red Hat Enterprise Linux servers and workstations, Smart Card login
> +is not enabled by default and must be enabled in the system settings.
> +Detailed procedures on how to configure a system to use Smart Card
> +authentication for login can be found in the Red Hat Documentation web site:
> +<ul>
> +<li>https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html</li>
> +</ul>

I would end the patch here. We don't want to get caught up in 
implementation details that are spelt out in other authoritative guides.

An ending line stating "It is recommended to use Smart Cards wherever 
feasible as part of a multifactor authentication system" would be 
appropriate.


> +The following packages are required in order to enable use of Smart Cards
> +on RHEL:
> +<ul>
> +<li>nss-tools</li>
> +<li>esc</li>
> +<li>pam_pkcs11</li>
> +<li>coolkey</li>
> +<li>ccid</li>
> +<li>gdm</li>
> +<li>authconfig</li>
> +<li>authconfig-gtk</li>
> +<li>krb5-libs</li>
> +<li>krb5-workstation</li>
> +<li>krb5-auth-dialog</li>
> +<li>krb5-pkinit-openssl</li>
> +</ul>
> +</description>
> +<ref disa="" />
> +</Group>
> +
>   </Group>
>   </Group>




More information about the scap-security-guide mailing list