共通アクセスカード - 版の履歴

Kusanaginoturugi: カテゴリを変更

2023-08-26T12:51:44Z

カテゴリを変更

← 古い版		2023年8月26日 (土) 21:51時点における版
1行目:		1行目:
	[[Category:ハード~~ウェア~~]]		[[Category:スマートカード]]
	[[en:Common Access Card]]		[[en:Common Access Card]]
	{{Related articles start}}		{{Related articles start}}

Ny-a: 言語間リンクを追加

2022-08-22T00:02:08Z

言語間リンクを追加

← 古い版		2022年8月22日 (月) 09:02時点における版
1行目:		1行目:
	[[Category:ハードウェア]]		[[Category:ハードウェア]]
			[[en:Common Access Card]]
	{{Related articles start}}		{{Related articles start}}
	{{Related\|スマートカード}}		{{Related\|スマートカード}}
159行目:		160行目:

	* [https://piv.idmanagement.gov/engineering/ PIV Usage Guides]		* [https://piv.idmanagement.gov/engineering/ PIV Usage Guides]

			{{TranslationStatus\|Common Access Card\|2022-05-26\|717820}}

Kusanaginoturugi: 空白を削除

2022-05-26T02:20:51Z

空白を削除

← 古い版		2022年5月26日 (木) 11:20時点における版
3行目:		3行目:
	{{Related\|スマートカード}}		{{Related\|スマートカード}}
	{{Related articles end}}		{{Related articles end}}
	このページでは、米国国防総省の [[wikipedia:Common_Access_Card\|共通アクセスカード]] (CAC) を使用するための Arch の設定方法について説明します。		このページでは、米国国防総省の[[wikipedia:Common_Access_Card\|共通アクセスカード]] (CAC) を使用するための Arch の設定方法について説明します。

	== インストール ==		== インストール ==

Kusanaginoturugi: 一部飜訳

2022-05-26T02:20:36Z

一部飜訳

← 古い版		2022年5月26日 (木) 11:20時点における版
3行目:		3行目:
	{{Related\|スマートカード}}		{{Related\|スマートカード}}
	{{Related articles end}}		{{Related articles end}}
			このページでは、米国国防総省の [[wikipedia:Common_Access_Card\|共通アクセスカード]] (CAC) を使用するための Arch の設定方法について説明します。
	This page explains how to setup Arch to use a US Department of Defense [[wikipedia:Common_Access_Card\|Common Access Card]] (CAC).

	== ~~Installation~~ ==		== インストール ==

	~~Install~~ {{Pkg\|ccid}} ~~and~~ {{Pkg\|opensc}} ~~from [[official repositories]].~~		[[公式リポジトリ]] から {{Pkg\|ccid}} と {{Pkg\|opensc}} をインストールします。

	=== ~~Configuration~~ ===		=== 設定 ===

	{{Note\|You should not have to edit your opensc configuration files by default. You should check all other setup items first (e.g. certificate imports)}}		{{Note\|You should not have to edit your opensc configuration files by default. You should check all other setup items first (e.g. certificate imports)}}
17行目:		17行目:
	Sometimes {{Pkg\|opensc}} can struggle to identify the proper driver for CAC, instead it may choose PIV or something else. You can force the CAC driver by editing {{ic\|/etc/opensc.conf}} for {{ic\|1=card_drivers = cac}} and {{ic\|1=force_card_driver = cac}}		Sometimes {{Pkg\|opensc}} can struggle to identify the proper driver for CAC, instead it may choose PIV or something else. You can force the CAC driver by editing {{ic\|/etc/opensc.conf}} for {{ic\|1=card_drivers = cac}} and {{ic\|1=force_card_driver = cac}}

	== ~~Enable~~ pcscd ==		== pcscd を有効にする ==

	~~[[Start]] and enable~~ {{ic\|pcscd.socket}}.		{{ic\|pcscd.socket}} を [[開始]] して有効にします。

	== Configure browser ==		== Configure browser ==
30行目:		30行目:
	=== Firefox ===		=== Firefox ===

			==== セキュリティデバイスをロードする ====
	==== Load security device ====

	Navigate to ''Edit -> Preference -> Advanced -> Certificates -> Security Devices'' and click "Load" to load a module using {{ic\|/usr/lib/opensc-pkcs11.so}} or {{ic\|/usr/lib/pkcs11/opensc-pkcs11.so}}.		Navigate to ''Edit -> Preference -> Advanced -> Certificates -> Security Devices'' and click "Load" to load a module using {{ic\|/usr/lib/opensc-pkcs11.so}} or {{ic\|/usr/lib/pkcs11/opensc-pkcs11.so}}.
156行目:		156行目:
	DoD CAC, Oberthur ID One 128 v5.5 Dual		DoD CAC, Oberthur ID One 128 v5.5 Dual

	== ~~See also~~ ==		== 参照 ==

	* [https://piv.idmanagement.gov/engineering/ PIV Usage Guides]		* [https://piv.idmanagement.gov/engineering/ PIV Usage Guides]
	*

Kusanaginoturugi: Kusanaginoturugi がページ「Common Access Card」を「共通アクセスカード」に移動しました: いくつかのページでそのように飜訳されている

2022-05-26T02:16:00Z

Kusanaginoturugi がページ「Common Access Card」を「共通アクセスカード」に移動しました: いくつかのページでそのように飜訳されている

← 古い版		2022年5月26日 (木) 11:16時点における版
(相違点なし)

Kusanaginoturugi: カテゴリを訂正

2022-05-25T01:38:33Z

カテゴリを訂正

← 古い版		2022年5月25日 (水) 10:38時点における版
1行目:		1行目:
	[[Category:~~Hardware~~]]		[[Category:ハードウェア]]
	{{Related articles start}}		{{Related articles start}}
	{{Related\|スマートカード}}		{{Related\|スマートカード}}

Kusanaginoturugi: 英語版より記事を転載

2022-05-25T01:32:14Z

英語版より記事を転載

新規ページ

[[Category:Hardware]]
{{Related articles start}}
{{Related|スマートカード}}
{{Related articles end}}
This page explains how to setup Arch to use a US Department of Defense [[wikipedia:Common_Access_Card|Common Access Card]] (CAC).

== Installation ==

Install {{Pkg|ccid}} and {{Pkg|opensc}} from [[official repositories]].

=== Configuration ===

{{Note|You should not have to edit your opensc configuration files by default. You should check all other setup items first (e.g. certificate imports)}}

If your card reader does not have a pin pad, uncomment {{ic|1=enable_pinpad = false}} in {{ic|/etc/opensc.conf}}.

Sometimes {{Pkg|opensc}} can struggle to identify the proper driver for CAC, instead it may choose PIV or something else. You can force the CAC driver by editing {{ic|/etc/opensc.conf}} for {{ic|1=card_drivers = cac}} and {{ic|1=force_card_driver = cac}}

== Enable pcscd ==

[[Start]] and enable {{ic|pcscd.socket}}.

== Configure browser ==

# Go to: https://public.cyber.mil/pki-pke/pkipke-document-library/
# Download certs: ''"PKI CA Certificate Bundles: PKCS#7 For DoD PKI Only - Version 5.9"'' (ZIP Download)
# Unzip the DoD PKI zip
# Follow browser-specific instructions

=== Firefox ===

==== Load security device ====

Navigate to ''Edit -> Preference -> Advanced -> Certificates -> Security Devices'' and click "Load" to load a module using {{ic|/usr/lib/opensc-pkcs11.so}} or {{ic|/usr/lib/pkcs11/opensc-pkcs11.so}}.

{{Note|Firefox may report the module did not load correctly however you will have to check in the security devices to confirm whether the module properly loaded or not}}

==== Import the DoD Certificates ====

Install the certificates from the mentioned zip-file in ''this'' order, by going to ''Edit -> Preference -> Advanced -> Certificates -> View Certificates -> Authorities -> Import'' (make sure to at-least check the box for "Trust this CA to identify websites"):

{{Note|As of the 5.9 version of the certificate zip}}

# Certificates_PKCS7_v5.9_DoD.der.p7b
# Certificates_PKCS7_v5.9_DoD_DoD_Root_CA_2.der.p7b
# Certificates_PKCS7_v5.9_DoD_DoD_Root_CA_3.der.p7b
# Certificates_PKCS7_v5.9_DoD_DoD_Root_CA_4.der.p7b
# Certificates_PKCS7_v5.9_DoD_DoD_Root_CA_5.der.p7b
# Certificates_PKCS7_v5.9_DoD.pem.p7b

=== Chromium/Google Chrome ===

1. Add the CAC Module to the NSS DB.

Ensure that your CAC is connected, that [[Chromium]] is closed and enter the following in a terminal:
{{ic|<nowiki>$ modutil -dbdir sql:$HOME/.pki/nssdb/ -add "CAC Module" -libfile /usr/lib/opensc-pkcs11.so</nowiki>}}
{{Note|You may see the message 'Failure to load dynamic library'. This can be ignored.}}
Upon success you will see "Module "CAC Module" added to database."

2. Check if the CAC Module was successfully added with {{ic|<nowiki>$ modutil -dbdir sql:$HOME/.pki/nssdb/ -list</nowiki>}}

{{Accuracy|The following step is NOT WORKING WITH v5.4 of certs because Chrome does not exist in the filenames, I ''think'' it should be Certificate instead of Chrome)}}

3. Navigate (in a shell) to the location of the unzip DoD PKI files and install via:

for n in $(ls * | grep Chrome); do certutil -d sql:$HOME/.pki/nssdb -A -t TC -n $n -i $n; done

or

Re-open Chrome, Navigate to ''Settings -> Show Advanced Settings -> Manage Certificates -> Authorities'' to load CA bundle from the PEM-formatted file from above.

4. Verify the authority is in Chrome under ''Settings -> Show Advanced Settings -> Manage Certificates -> Authorities'' then expand "org-U.S. Government" and you should see a number of "DoD" certificates listed.

== VMware Horizon Client ==

Install {{AUR|vmware-horizon-client}}, {{AUR|vmware-horizon-usb}}, and {{AUR|vmware-horizon-smartcard}}. [[Start]] and [[enable]] {{ic|vmware-horizon-usb.service}}.

To integrate CAC authentication with the VMware Horizon Client, create the directory {{ic|/usr/lib/vmware/view/pkcs11}} and link the pkcs11 library:

# ln -s /usr/lib64/pkcs11/opensc-pkcs11.so /usr/lib/vmware/view/pkcs11/libopenscpkcs11.so

== Testing ==

Visit your favorite CAC secured web page and you should be asked for the ''Master Password'' for your certificate. Enter it and if you get in, you know it is working.

If some sites/pages seem to have a problem working correctly (e.g. outlook web access will not authenticate the session for DoD webmail) try using a private/incognito session to test validity of the cert chain and remove some variables.

== Debugging ==

=== opensc-tool ===

Most of this information was found in a [https://web.archive.org/web/20200505031254/http://blog.fkraiem.org/2013/03/13/linux-smart-card-authentication-howto/ blog post by Firas Kraïem]

Verify opensc can see your reader
{{hc|$ opensc-tool --list-readers |
# Detected readers (pcsc)
Nr. Card Features Name
0 Yes Generic USB2.0-CRW [Smart Card Reader Interface] (20070818000000000) 00 00}}
List plugged in card
{{hc|$ opensc-tool --reader 0 --name |Personal Identity Verification Card}}
List plugged in card and drive in use
{{hc|$ opensc-tool --reader 0 --name -v|
Connecting to card in reader Generic USB2.0-CRW [Smart Card Reader Interface] (20070818000000000) 00 00...
Using card driver Personal Identity Verification Card.
Card name: Personal Identity Verification Card}}

=== pcsc-tools ===

The {{Pkg|pcsc-tools}} package is also availabe in '''[community]'''. The program {{ic|pcsc_scan}} may be helpful

[cceleri@ender ~]$ pcsc_scan
PC/SC device scanner
V 1.4.21 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau@free.fr>
Compiled with PC/SC lite version: 1.8.6
Using reader plug'n play mechanism
Scanning present readers...
0: Dell Dell Smart Card Reader Keyboard 00 00

Thu Sep 5 10:41:53 2013
Reader 0: Dell Dell Smart Card Reader Keyboard 00 00
Card state: Card removed,

Thu Sep 5 10:41:58 2013
Reader 0: Dell Dell Smart Card Reader Keyboard 00 00
Card state: Card inserted,
ATR: 3B DB 96 00 80 1F 03 00 31 C0 64 B0 F3 10 00 07 90 00 80

ATR: 3B DB 96 00 80 1F 03 00 31 C0 64 B0 F3 10 00 07 90 00 80
+ TS = 3B --> Direct Convention
+ T0 = DB, Y(1): 1101, K: 11 (historical bytes)
TA(1) = 96 --> Fi=512, Di=32, 16 cycles/ETU
250000 bits/s at 4 MHz, fMax for Fi = 5 MHz => 312500 bits/s
TC(1) = 00 --> Extra guard time: 0
TD(1) = 80 --> Y(i+1) = 1000, Protocol T = 0
-----
TD(2) = 1F --> Y(i+1) = 0001, Protocol T = 15 - Global interface bytes following
-----
TA(3) = 03 --> Clock stop: not supported - Class accepted by the card: (3G) A 5V B 3V
+ Historical bytes: 00 31 C0 64 B0 F3 10 00 07 90 00
Category indicator byte: 00 (compact TLV data object)
Tag: 3, len: 1 (card service data byte)
Card service data byte: C0
- Application selection: by full DF name
- Application selection: by partial DF name
- EF.DIR and EF.ATR access services: by GET RECORD(s) command
- Card with MF
Tag: 6, len: 4 (pre-issuing data)
Data: B0 F3 10 00
Mandatory status indicator (3 last bytes)
LCS (life card cycle): 07 (Operational state (activated))
SW: 9000 (Normal processing.)
+ TCK = 80 (correct checksum)

Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
3B DB 96 00 80 1F 03 00 31 C0 64 B0 F3 10 00 07 90 00 80
DoD CAC, Oberthur ID One 128 v5.5 Dual

== See also ==

* [https://piv.idmanagement.gov/engineering/ PIV Usage Guides]
*