macOS Sierra and pam_smartcard

Ludovic Rousseau

2016-12-07 14:52

In Sierra a new smart card component has been introduced: pam_smartcard. PAM is Pluggable Authentication Modules.

The source code is available at macOS 10.12 Source and is part of the pam_modules component.

pam_smartcard

The pam_smartcard(8) manage is:

pam_smartcard(8)          BSD System Manager's Manual         pam_smartcard(8)

NAME
     pam_smartcard -- Smartcard PAM module

SYNOPSIS
     [service-name] function-class control-flag pam_smartcard [options]

DESCRIPTION
     The Smartcard PAM module supports authentication function class.  In
     terms of the function-class parameter, this is ``auth.''

   The Smartcard Authentication Module
     This module permits or denies users based on smartcard authentication
     support in the Open Directory database, and the presence of an appropri-
     ate smartcard in the reader attached to the local machine. When a card is
     locked, the user is asked to unlock it with his PIN.

   The following options may be passed to this account management module:
     no_check_shell
             Continues evaluation even if user's shell is not valid. Normally,
             users with a shell like /usr/bin/false are considered as dis-
             abled.

EXAMPLE
     Adding the following line on the top of the /etc/pam.d/sudo enables smartcard support for sudo:
             auth   sufficient     pam_smartcard.so

SEE ALSO
     pam.conf(5), pam(8) SmartCardServices(7)

BSD                             August 27, 2015                            BSD

I guess this is related to the introduction of the native support of PIV cards in Sierra. See "macOS Sierra and PIVToken source code".

The pam_smartcard PAM module is used by two services by default:

authorization_ctk
screensaver_ctk

$ grep pam_smartcard /etc/pam.d/*
/etc/pam.d/authorization_ctk:auth       required       pam_smartcard.so  use_first_pass
/etc/pam.d/screensaver_ctk:auth       required       pam_smartcard.so  use_first_pass

$ cat /etc/pam.d/authorization_ctk 
# ctk: auth 
auth       required       pam_smartcard.so   use_first_pass
account    required       pam_opendirectory.so

$ cat /etc/pam.d/screensaver_ctk 
# ctk: auth 
auth       required       pam_smartcard.so  use_first_pass
account    required       pam_opendirectory.so
account    sufficient     pam_self.so
account    required       pam_group.so no_warn group=admin,wheel fail_safe
account    required       pam_group.so no_warn deny group=admin,wheel ruser fail_safe

SmartCardServices

Another interesting man page is SmartCardServices(7). Here is an extract:

SmartCardServices(7) BSD Miscellaneous Information Manual SmartCardServices(7)

NAME
SmartCardServices -- overview of smart card support

DESCRIPTION
SmartCardServices is a set of components for OS X smart card support.

Any smart card which supports the PIV standard is supported natively by
OS X. Access to smart card items is possible using the keychain inter-
face. Applications can install additional drivers for smart cards that
are not natively supported.

Smart card certificates are automatically added to user's keychain when a
smart card is inserted. Smart card certificates can be listed with
security using the list-smartcards or export-smartcard commands. Keychain
Access GUI cannot be used to manipulate or list these certificates.

SETUP
To associate users with smart cards, the system can be set up for either
fixed key mapping or attribute based mapping. For fixed key use
sc_auth(8) or use the dialog which appears automatically when an unasso-
ciated smartcard is inserted into a reader. This dialog can be globally
suppressed by:

sudo defaults write /Library/Preferences/com.apple.security.smartcard UserPairing -bool NO

Attribute matching can be set up using the appropriate AttributeMapping
section in the configuration file as described below. There is no default
configuration. If no AttributeMapping exists or the configuration file is
missing, attribute matching is not used. If both fixed key mapping and
attribute mapping are able to associate the inserted smart card with a
user, attribute mapping takes precedence.

By default certificates do not need to be trusted to allow association.
Certificate trust can be globally enforced by setting:

sudo defaults write /Library/Preferences/com.apple.security.smartcard checkCertificateTrust -bool YES

[...]

PAM PKCS#11?

Since PAM is available in macOS maybe the PAM PKCS#11 module can be used without too much changes? This module is for GNU/Linux but may be adapted for macOS.

In this case, adding support for smart card login in macOS, if you already have a PKCS#11 library for your card, should be easy.

Conclusion

The use of smart card in macOS for high level services (like authentication) is easier in Sierra, at least for PIV smart cards.

I imagine that the support of other smart cards models will be proposed by third parties "soon".