Bug 644825
| Summary: | 'kinit' with smart card login fails to authenticate to the kdc using the cert and its private key. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | RHEL Program Management <pm-rhel> |
| Component: | krb5 | Assignee: | Nalin Dahyabhai <nalin> |
| Status: | CLOSED ERRATA | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 6.0 | CC: | aakkiang, ckannan, cmeadors, ddumas, dpal, ebenes, jmagne, jplans, mkhusid, nalin, pm-eus, rstrode, syeghiay |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=6775 | ||
| Whiteboard: | |||
| Fixed In Version: | krb5-1.8.2-3.el6_0.2 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-11-30 22:43:59 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 629022 | ||
| Bug Blocks: | |||
|
Description
RHEL Program Management
2010-10-20 11:51:44 UTC
Tested kerberos user smart card login using Gemalto 64K and CAC card with a Rhel 6 and Rhel 5.5 KDC. Smart card authentication succeeds and the kerberos credentials issued successfully on a i686 and x86_64 Rhel 6.0 Desktop. Rpms from http://errata.devel.redhat.com/errata/show/10274 : krb5-debuginfo-1.8.2-3.el6_0.3 krb5-pkinit-openssl-1.8.2-3.el6_0.3 krb5-workstation-1.8.2-3.el6_0.3 krb5-libs-1.8.2-3.el6_0.3 Steps: 1. Configured a Rhel 6 desktop to do smart card login. loaded up root certs onto /etc/pki/nssdb. 2. Edit /etc/krb5.conf with the KDC and the client ticket details. Configure krb5.conf with trust anchors, example: pkinit_anchors = FILE:/etc/pki/nssdb/kdc-ca.pem pkinit_cert_match = <KU>digitalSignature 3. yum install krb5-pkinit-openssl. Edit /etc/pam.d/smartcard-auth and /etc/pam.d/system-auth to use pam_krb5 with preauth_options=pkinit_identities=PKCS11:/usr/lib64/pkcs11/libcoolkeypk11.so 4. /etc/pki/nssdb/kdc-ca.pem contains CA certificates in base64 encoded format. CA that issued smart card and CA that issued KDC certificate. kdc-ca.pem on KDC also has these CA certificates. 5. Used the card to perform smart card login. Logged in successfully and the kerberos credential is issued. Marking this bug verified. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2010-0925.html |