smartcard(5) Standards, Environments, and Macros smartcard(5)NAME
smartcard - overview of smart card features on Solaris
DESCRIPTION
The smart card framework provides a mechanism to abstract the details of interacting with smart cards and smart cardreaders (called card
terminals). The framework is based on the OpenCard Framework V1.1 (OCF) with Sun extensions to allow OCF to operate in a multi-user envi-
ronment. The core OCF software protocol stack is implemented as a system service daemon. This implementation allows smart cards and card
terminals to be shared cooperatively among many different clients on the system while providing access control to the smart card and card
terminal resources on a per-UID basis.
An event dispatcher is provided to inform clients of events occuring on the card and at the card terminal, such as card insertion and card
removal.
A high-level authentication mechanism is provided to allow clients to perform smart card-based authentications without requiring knowledge
of specific card or reader authentication features.
A set of applet administration tools is provided for JavaCards that support downloading Java applets (although applet build tools are not
provided).
Administration of the smart card framework is provided with the smartcard(1M) command line administration utility and the smartcardguiad-
min(1) GUI administration tool.
Support the following card terminal is provided:
o Dallas iButton Serial Reader (see ocf_ibutton(7D))
Additional card terminals can be supported by implementing smart card terminal interfaces in a shared library.
Support for several smart cards is provided:
o Schlumberger Cyberflex Access JavaCard
o Schlumberger MicroPayflex
o Dallas Semiconductor Java iButton JavaCard
Each of the supported cards has a complete set of OCF card services that implement the necessary functionality for authentication and
secure storage of data. For the two supported JavaCards, an authentication and secure data storage applet is provided that can be loaded
into these cards with the supplied applet administration tools. See smartcard(1M).
A PAM smart card module is provided to allow PAM clients to use smart card-based authentication. See pam_smartcard(5)
CDE is able to use the PAM smart card module for dtlogin and dtsession authentication. CDE also uses the smart card framework event dis-
patcher to listen for events on the card terminal and provide corresponding visual feedback to the user.
SEE ALSO ocfserv(1M), smartcard(1M), libsmartcard(3LIB), pam_start(3PAM), pam_smartcard(5), ocf_ibutton(7D), scmi2c(7D)SunOS 5.10 16 Oct 2002 smartcard(5)
Check Out this Related Man Page
pam_smartcard(5) Standards, Environments, and Macros pam_smartcard(5)NAME
pam_smartcard - PAM authentication module for Smart Card
SYNOPSIS
/usr/lib/security/pam_smartcard.so
DESCRIPTION
The Smart Card service module for PAM, /usr/lib/security/pam_smartcard.so, provides functionality to obtain a user's information (such as
user name and password) for a smart card. The pam_smartcard.so module is a shared object that can be dynamically loaded to provide the nec-
essary functionality upon demand. Its path is specified in the PAM configuration file pam.conf. See pam.conf(4).
Smart Card Authentication Module
The Smart Card authentication component provides the pam_sm_authenticate(3PAM) function to verify the identity of a smart card user.
The pam_sm_authenticate() function collects as user input the PIN number. It passes this data back to its underlying layer, OCF, to perform
PIN verification. If verification is successful, the module returns PAM_SUCCESS, and passes the username and password from the smart card
to PAM modules stacked below.pam_smartcard.
The following options can be passed to the Smart Card service module:
debug syslog(3C) debugging information at LOG_DEBUG level.
nowarn Turn off warning messages.
verbose Turn on verbose authentication failure reporting to the user.
Smart Card Module Configuration
The PAM smart card module (pam_smartcard) can be configured in the PAM configuration file (/etc/pam.conf). For example, the following con-
figuration on on the desktop (Common Desktop Environment) forces a user to use a smart card for logging in.
The following are typical values set by 'smartcard -c enable', if the command is applied to the default configuration.
dtlogin auth requisite pam_smartcard.so.1
dtlogin auth required pam_authtok_get.so.1
dtlogin auth required pam_dhkeys.so.1
dtsession auth requisite pam_smartcard.so.1
dtsession auth required pam_authtok_get.so.1
dtsession auth required pam_dhkeys.so.1
SEE ALSO smartcard(1M), libpam(3LIB), pam(3PAM), pam_authenticate(3PAM), pam_start(3PAM), pam.conf(4), pam_authtok_check(5), pam_authtok_get(5),
pam_authtok_store(5), pam_dhkeys(5), pam_passwd_auth(5), pam_unix_account(5), pam_unix_auth(5), pam_unix_session(5)NOTES
The pam_unix(5) module is no longer supported. Similar functionality is provided by pam_authtok_check(5), pam_authtok_get(5), pam_auth-
tok_store(5), pam_dhkeys(5), pam_passwd_auth(5), pam_unix_account(5), pam_unix_auth(5), and pam_unix_session(5).
SunOS 5.10 24 Oct 2002 pam_smartcard(5)