ADMIN

Nuts and Bolts
PAM and Hardware
Next, you still need to add the PAM
pam_pkcs11 library to the correct
PAM configuration file – that is, /etc/
pam.d/login or /etc/pam.d/gdm. You
can edit the file manually or use the
system‐config‐authentication tool
referred to previously.
When you insert the chip card into
the reader and launch the ESC tool,
you should be able to see the certificate
(Figure 8). If you now attempt
to log in via the console or a new
GDM session, the authentication process
should be completely transparent.
The Thunderbird email program
can use the card to sign and encrypt
email; Firefox can use the certificate
for client-side authentication against
a web server. The reward for all this
configuration is a large choice of deployment
scenarios. The ESC Guide
[10] has a more detailed description
of the tool and its configuration.
Conclusions
Figure 8: The Security Client gives you an easy option for managing chip cards.
chip card, you can transfer a prebuilt
PKCS#12 file [8] to the card using:
pkcs15‐init U
‐‐store‐private‐key tscherf.p12 U
‐‐format pkcs12 U
‐‐auth‐id 01
The PKCS#12 file contains both the
public key and private key. If you
have a user certificate from a public
certification authority like CACert [9],
you can use your browser’s certificate
management facility to export the certificate
to a file and then transfer it to
the chip card as described.
If you don’t have a certificate, you
can create a request and send it to
the appropriate certificate authority.
Once the authority has verified your
request, it will return a certificate to
you.
For both approaches, you can use the
/etc/pam_pkcs11/pam_pkcs11.conf file
to define the driver for access to the
chip card. The driver can be modified
in the configuration file, as shown in
Listing 4.
Here, you must specify the correct
paths to the local CRL and CA certificate
repository. The CRL database is
necessary to check that the certificate
on a user’s chip card is still valid and
has not been revoked by the certificate
authority. You need the certificate
for the certificate authority that
issued the user’s certificate from the
CA certificate repository. This makes
it possible to validate the user’s authenticity.
Certificates for
Thunderbird and Co.
Applications that rely on Network
Security Services (NSS) for signing or
encrypting email with S/​MIME, such
as Thunderbird, use a file in the nss_
dir as the CA database; applications
based on the OpenSSL libraries use
the database in the ca_dir directory.
The certutil tool can import the
CA certificate into the NSS database;
OpenSSL-based certificates can simply
be appended to the existing file.
Finally, you can define the mappings
between user certificates and Linux
users in the pam_pkcs11 configuration
file. Various mapping tools are available
for this, specified as follows:
use_mappers = cn, uid
PAM is a very powerful framework
for handling authentication. As
you can see from the PAM libraries
introduced in this article, the functional
scope is not just restricted to
authenticating users but also covers
tasks such as authorization, password
management, and session management.
Administrators who take the
time to familiarize themselves with
configuring PAM, which isn’t always
trivial, will be rewarded with a feast
of feature-rich and flexible options for
password- and hardware-based authentication
and authorization. n
Info
[1] Linux PAM: [http:// www. kernel. org/ pub/​
linux/ libs/ pam/]
[2] PAM ThinkFinger:
[http:// thinkfinger. sourceforge. net]
[3] pam_usb:
[http:// downloads. sourceforge. net/​
pamusb/ pam_usb‐0. 4. 2. tar. gz? download]
[4] Yubico website: [http:// www. yubico. com/​
products/ yubikey/]
[5] SSH server for Yubikey: [http:// code.​
google. com/ p/ yubico‐pam/ downloads/]
[6] Dogtag PKI: [http:// pki‐svn. fedora. redhat.​
com/ wiki/ PKI_Main_Page]
[7] OpenSC: [http:// www. opensc‐project. org]
[8] PKCS specifications:
[http:// en. wikipedia. org/ wiki/ PKCS]
[9] CACert certificate authority:
[http:// cacert. com]
[10] ESC Guide: [http:// directory.​
fedoraproject. org/ wiki/ ESC_Guide]
The Author
Thorsten Scherf is a Senior Consultant for Red
Hat EMEA. You can meet him as a speaker at
conferences. He is also a keen marathon runner
whenever time permits.
84 Admin 01 www.admin-magazine.com