Chapter 6. Configuring smart card authentication with local certificates

Procedure

1. Create a directory where you can generate the certificate, for example:

   # mkdir /tmp/ca
   # cd /tmp/ca

2. Set up the certificate (copy this text to your command line in the ca directory):

   cat > ca.cnf <<EOF
   [ ca ]
   default_ca = CA_default
   
   [ CA_default ]
   dir              = .
   database         = \$dir/index.txt
   new_certs_dir    = \$dir/newcerts
   
   certificate      = \$dir/rootCA.crt
   serial           = \$dir/serial
   private_key      = \$dir/rootCA.key
   RANDFILE         = \$dir/rand
   
   default_days     = 365
   default_crl_days = 30
   default_md       = sha256
   
   policy           = policy_any
   email_in_dn      = no
   
   name_opt         = ca_default
   cert_opt         = ca_default
   copy_extensions  = copy
   
   [ usr_cert ]
   authorityKeyIdentifier = keyid, issuer
   
   [ v3_ca ]
   subjectKeyIdentifier   = hash
   authorityKeyIdentifier = keyid:always,issuer:always
   basicConstraints       = CA:true
   keyUsage               = critical, digitalSignature, cRLSign, keyCertSign
   
   [ policy_any ]
   organizationName       = supplied
   organizationalUnitName = supplied
   commonName             = supplied
   emailAddress           = optional
   
   [ req ]
   distinguished_name = req_distinguished_name
   prompt             = no
   
   [ req_distinguished_name ]
   O  = Example
   OU = Example Test
   CN = Example Test CA
   EOF

3. Create the following directories:

   # mkdir certs crl newcerts

4. Create the following files:

   # touch index.txt crlnumber index.txt.attr

5. Write the number 01 in the serial file:

   # echo 01 > serial

   This command writes a number 01 in the serial file. It is a serial number of the certificate. With each new certificate released by this CA the number increases by one.

6. Create an OpenSSL root CA key:

   # openssl genrsa -out rootCA.key 2048

7. Create a self-signed root Certification Authority certificate:

   # openssl req -batch -config ca.cnf \
       -x509 -new -nodes -key rootCA.key -sha256 -days 10000 \
       -set_serial 0 -extensions v3_ca -out rootCA.crt

8. Create the key for your username:

   # openssl genrsa -out example.user.key 2048

   This key is generated in the local system which is not secure, therefore, remove the key from the system when the key is stored in the card.

   You can create a key directly in the smart card as well. For doing this, follow instructions created by the manufacturer of your smart card.

9. Create the certificate signing request configuration file (copy this text to your command line in the ca directory):

   cat > req.cnf <<EOF
   [ req ]
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   O = Example
   OU = Example Test
   CN = testuser
   
   [ req_exts ]
   basicConstraints = CA:FALSE
   nsCertType = client, email
   nsComment = "testuser"
   subjectKeyIdentifier = hash
   keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = clientAuth, emailProtection, msSmartcardLogin
   subjectAltName = otherName:msUPN;UTF8:testuser@EXAMPLE.COM, email:testuser@example.com
   EOF

10. Create a certificate signing request for your example.user certificate:

    # openssl req -new -nodes -key example.user.key \
        -reqexts req_exts -config req.cnf -out example.user.csr

11. Configure the new certificate. Expiration period is set to 1 year:

    # openssl ca -config ca.cnf -batch -notext \
        -keyfile rootCA.key -in example.user.csr -days 365 \
        -extensions usr_cert -out example.user.crt

Procedure

1. Ensure that you have SSSD installed on the system.

   # rpm -q sssd
   sssd-2.0.0.43.el8_0.3.x86_64

2. Create a /etc/sssd/pki directory:

   # file /etc/sssd/pki
   /etc/sssd/pki/: directory

3. Copy the rootCA.crt as a PEM file in the /etc/sssd/pki/ directory:

   # cp /tmp/ca/rootCA.crt /etc/sssd/pki/sssd_auth_ca_db.pem

Procedure

1. Install the opensc and gnutls-utils packages:

   # {PackageManagerCommand} -y install opensc gnutls-utils

2. Start the pcscd service.

   # systemctl start pcscd

Procedure

1. Erase your smart card and authenticate yourself with your PIN:

   $ pkcs15-init --erase-card --use-default-transport-keys
   Using reader with a card: Reader name
   PIN [Security Officer PIN] required.
   Please enter PIN [Security Officer PIN]:

   The card has been erased.

2. Initialize your smart card, set your user PIN and PUK, and your Security Officer PIN and PUK:

   $ pkcs15-init --create-pkcs15 --use-default-transport-keys \ --pin 963214 --puk 321478 --so-pin 65498714 --so-puk 784123
   Using reader with a card: Reader name

   The pcks15-init tool creates a new slot on the smart card.

3. Set a label and the authentication ID for the slot:

   $ pkcs15-init --store-pin --label testuser \ --auth-id 01 --so-pin 65498714 --pin 963214 --puk 321478
   Using reader with a card: Reader name

   The label is set to a human-readable value, in this case, testuser. The auth-id must be two hexadecimal values, in this case it is set to 01.

4. Store and label the private key in the new slot on the smart card:

   $ pkcs15-init --store-private-key testuser.key --label testuser_key \ --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   The value you specify for --id must be the same when storing your private key and storing your certificate in the next step. Specifying your own value for --id is recommended as otherwise a more complicated value is calculated by the tool.

5. Store and label the certificate in the new slot on the smart card:

   $ pkcs15-init --store-certificate testuser.crt --label testuser_crt \ --auth-id 01 --id 01 --format pem --pin 963214
   Using reader with a card: Reader name

6. Optional: Store and label the public key in the new slot on the smart card:

   $ pkcs15-init --store-public-key testuserpublic.key --label testuserpublic_key --auth-id 01 --id 01 --pin 963214
   Using reader with a card: Reader name

   Note

   If the public key corresponds to a private key or certificate, specify the same ID as the ID of the private key or certificate.

7. Optional: Certain smart cards require you to finalize the card by locking the settings:

   $ pkcs15-init -F

   At this stage, your smart card includes the certificate, private key, and public key in the newly created slot. You have also created your user PIN and PUK and the Security Officer PIN and PUK.

Procedure

1. Create a new directory for SSH keys in the home directory of the user who uses smart card authentication:

   # mkdir /home/example.user/.ssh

2. Run the ssh-keygen -D command with the opensc library to retrieve the existing public key paired with the private key on the smart card, and add it to the authorized_keys list of the user’s SSH keys directory to enable SSH access with smart card authentication.

   # ssh-keygen -D /usr/lib64/pkcs11/opensc-pkcs11.so >> ~example.user/.ssh/authorized_keys

3. SSH requires access right configuration for the /.ssh directory and the authorized_keys file. To set or change the access rights, enter:

   # chown -R example.user:example.user ~example.user/.ssh/
   # chmod 700 ~example.user/.ssh/
   # chmod 600 ~example.user/.ssh/authorized_keys

4. Optionally, display the keys:

   # cat ~example.user/.ssh/authorized_keys

   The terminal displays the keys.

5. Verify that the smart card authentication is enabled in the /etc/sssd/sssd.conf file:

   In the [pam] section, enable the pam certificate authentication module: pam_cert_auth = True

   If the sssd.conf file has not been created yet, you can create the minimal functional configuration by copying the following script to the command line:

   # cat > /etc/sssd/sssd.conf <<EOF
   [sssd]
   services = nss, pam
   domains = shadowutils
   
   [nss]
   
   [pam]
   pam_cert_auth = True
   
   [domain/shadowutils]
   id_provider = files
   EOF

6. To use the SSH keys, configure authentication with the authselect command:

   # authselect select sssd with-smartcard --force