5.9. Smart Card Authentication

Smart cards are an external hardware security feature, most commonly seen in credit cards, but also used by many businesses as authentication tokens. Smart cards can be used to protect Red Hat Virtualization virtual machines.

Enabling Smart Cards

  1. Ensure that the smart card hardware is plugged into the client machine and is installed according to manufacturer’s directions.
  2. Click Compute → Virtual Machines and select a virtual machine.
  3. Click Edit.
  4. Click the Console tab and select the Smartcard enabled check box.
  5. Click OK.
  6. Connect to the running virtual machine by clicking the Console button. Smart card authentication is now passed from the client hardware to the virtual machine.
Important

If the Smart card hardware is not correctly installed, enabling the Smart card feature will result in the virtual machine failing to load properly.

Disabling Smart Cards

  1. Click Compute → Virtual Machines and select a virtual machine.
  2. Click Edit.
  3. Click the Console tab, and clear the Smartcard enabled check box.
  4. Click OK.

Configuring Client Systems for Smart Card Sharing

  • Smart cards may require certain libraries in order to access their certificates. These libraries must be visible to the NSS library, which spice-gtk uses to provide the smart card to the guest. NSS expects the libraries to provide the PKCS #11 interface.
  • Make sure that the module architecture matches the spice-gtk / remote-viewer architecture. For instance, if you have only the 32b PKCS #11 library available, you must install the 32b build of virt-viewer in order for smart cards to work.

Configuring RHEL Clients for Smart Card support

Red Hat Enterprise Linux provides support for Smart cards. Install the Smart card support group. If the Smart Card Support group is installed on a Red Hat Enterprise Linux system, smart cards are redirected to the guest when Smart Cards are enabled.

  1. To install the Smart card support group, run the following command: 

    # dnf groupinstall "Smart card support"

Configuring RHEL Clients with Other Smart Card Middleware

Red Hat Enterprise Linux provides a system-wide registry of pkcs11 modules in the p11-kit, and these are accessible to all applications.

  1. To register the third party PKCS#11 library in the p11-kit database, run the following command as root: 

    # echo "module: /path/to/library.so" > /etc/pkcs11/modules/my.module

  2. To verify the Smart card is visible for p11-kit through this library run the following command: 

    $ p11-kit list-modules

Configuring Windows Clients

Red Hat does not provide PKCS #11 support to Windows clients. Libraries that provide PKCS #11 support must be obtained from third parties.

  1. When such libraries are obtained, register them by running the following command as a user with elevated privileges: 

    modutil -dbdir %PROGRAMDATA%\pki\nssdb -add "module name" -libfile C:_\Path\to\module_.dll