Chapter 31. Configuring smart card authentication with the web console for centrally managed users

Procedure

1. Install the opensc and gnutls-utils packages:

   # {PackageManagerCommand} -y install opensc gnutls-utils

2. Start the pcscd service.

   # systemctl start pcscd

Procedure

1. Erase your smart card and authenticate yourself with your PIN:

   $ pkcs15-init --erase-card --use-default-transport-keys
   Using reader with a card: Reader name
   PIN [Security Officer PIN] required.
   Please enter PIN [Security Officer PIN]:

   The card has been erased.

2. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:

   $ pkcs15-init --create-pkcs15 --use-default-transport-keys \ --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123
   Using reader with a card: Reader name

   The pcks15-init tool creates a new slot on the smart card.

3. Set a label and the authentication ID for the slot:

   $ pkcs15-init --store-pin --label testuser \ --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478
   Using reader with a card: Reader name

   The label is set to a human-readable value, in this case, testuser. The auth-id must be two hexadecimal values, in this case it is set to 01.

4. Store and label the private key in the new slot on the smart card:

   $ pkcs15-init --store-private-key testuser.key --label testuser_key \ --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   The value you specify for --id must be the same when storing your private key and storing your certificate in the next step. Specifying your own value for --id is recommended as otherwise a more complicated value is calculated by the tool.

5. Store and label the certificate in the new slot on the smart card:

   $ pkcs15-init --store-certificate testuser.crt --label testuser_crt \ --auth-id 01 --id 01 --format pem --pin 963214
   Using reader with a card: Reader name

6. Optional: Store and label the public key in the new slot on the smart card:

   $ pkcs15-init --store-public-key testuserpublic.key --label testuserpublic_key --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   If the public key corresponds to a private key or certificate, specify the same ID as the ID of the private key or certificate.

7. Optional: Certain smart cards require you to finalize the card by locking the settings:

   $ pkcs15-init -F

   At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.

Procedure

1. Log in to the RHEL web console with administrator privileges.

   For details, see Logging in to the web console.

2. Click Terminal.

3. In the /etc/cockpit/cockpit.conf, set the ClientCertAuthentication to yes:

   [WebService]
   ClientCertAuthentication = yes

4. Optional: Disable password based authentication in cockpit.conf with:

   [Basic]
   action = none

   This configuration disables password authentication and you must always use the smart card.

5. Restart the web console to ensure that the cockpit.service accepts the change:

   # systemctl restart cockpit

Procedure

1. Open your web browser and add the web console’s address in the address bar.

   The browser asks you to add the PIN protecting the certificate stored on the smart card.

2. In the Password Required dialog box, enter PIN and click OK.
3. In the User Identification Request dialog box, select the certificate stored in the smart card.

4. Select Remember this decision.

   The system does not open this window next time.

   Note

   This step does not apply to Google Chrome users.

5. Click OK.

Procedure

1. In the terminal, open the system-cockpithttps.slice configuration file:

   # systemctl edit system-cockpithttps.slice

2. Limit the TasksMax to 100 and CPUQuota to 30%:

   [Slice]
   # change existing value
   TasksMax=100
   # add new restriction
   CPUQuota=30%

3. To apply the changes, restart the system:

   # systemctl daemon-reload
   # systemctl stop cockpit