Chapter 6. Configuring smart card authentication with local certificates

Procedure

1. Create a directory where you can generate the certificate, for example:

   # mkdir /tmp/ca

   # cd /tmp/ca

2. Set up the certificate (copy this text to your command line in the ca directory):

   # cat > ca.cnf <<EOF

   [ ca ]
   default_ca = CA_default
   
   [ CA_default ]
   dir              = .
   database         = \$dir/index.txt
   new_certs_dir    = \$dir/newcerts
   
   certificate      = \$dir/rootCA.crt
   serial           = \$dir/serial
   private_key      = \$dir/rootCA.key
   RANDFILE         = \$dir/rand
   
   default_days     = 365
   default_crl_days = 30
   default_md       = sha256
   
   policy           = policy_any
   email_in_dn      = no
   
   name_opt         = ca_default
   cert_opt         = ca_default
   copy_extensions  = copy
   
   [ usr_cert ]
   authorityKeyIdentifier = keyid, issuer
   
   [ v3_ca ]
   subjectKeyIdentifier   = hash
   authorityKeyIdentifier = keyid:always,issuer:always
   basicConstraints       = CA:true
   keyUsage               = critical, digitalSignature, cRLSign, keyCertSign
   
   [ policy_any ]
   organizationName       = supplied
   organizationalUnitName = supplied
   commonName             = supplied
   emailAddress           = optional
   
   [ req ]
   distinguished_name = req_distinguished_name
   prompt             = no
   
   [ req_distinguished_name ]
   O  = Example
   OU = Example Test
   CN = Example Test CA
   EOF

3. Create the following directories:

   # mkdir certs crl newcerts

4. Create the following files:

   # touch index.txt crlnumber index.txt.attr

5. Write the number 01 in the serial file:

   # echo 01 > serial

   This command writes a number 01 in the serial file. It is a serial number of the certificate. With each new certificate released by this CA the number increases by one.

6. Create an OpenSSL root CA key:

   # openssl genrsa -out rootCA.key 2048

7. Create a self-signed root Certification Authority certificate:

   # openssl req -batch -config ca.cnf \ -x509 -new -nodes -key rootCA.key -sha256 -days 10000 \ -set_serial 0 -extensions v3_ca -out rootCA.crt

8. Create the key for your username:

   # openssl genrsa -out example.user.key 2048

   This key is generated in the local system which is not secure, therefore, remove the key from the system when the key is stored in the card.

   You can create a key directly in the smart card as well. For doing this, follow instructions created by the manufacturer of your smart card.

9. Create the certificate signing request configuration file (copy this text to your command line in the ca directory):

   # cat > req.cnf <<EOF

   [ req ]
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   O = Example
   OU = Example Test
   CN = testuser
   
   [ req_exts ]
   basicConstraints = CA:FALSE
   nsCertType = client, email
   nsComment = "testuser"
   subjectKeyIdentifier = hash
   keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = clientAuth, emailProtection, msSmartcardLogin
   subjectAltName = otherName:msUPN;UTF8:testuser@EXAMPLE.COM, email:testuser@example.com
   EOF

10. Create a certificate signing request for your example.user certificate:

    # openssl req -new -nodes -key example.user.key \ -reqexts req_exts -config req.cnf -out example.user.csr

11. Configure the new certificate. Expiration period is set to 1 year:

    # openssl ca -config ca.cnf -batch -notext \ -keyfile rootCA.key -in example.user.csr -days 365 \ -extensions usr_cert -out example.user.crt

    At this point, the certification authority and certificates are successfully generated and prepared for import into a smart card.

Procedure

1. Ensure that you have SSSD installed on the system.

   # rpm -q sssd

   sssd-2.0.0.43.el8_0.3.x86_64

2. Create a /etc/sssd/pki directory:

   # file /etc/sssd/pki

   /etc/sssd/pki/: directory

3. Copy the rootCA.crt as a PEM file in the /etc/sssd/pki/ directory:

   # cp /tmp/ca/rootCA.crt /etc/sssd/pki/sssd_auth_ca_db.pem

   Now you have successfully generated the certificate authority and certificates, and you have saved them in the /etc/sssd/pki directory.

   Note

   If you want to share the Certificate Authority certificates with another application, you can change the location in sssd.conf:

   • SSSD PAM responder: pam_cert_db_path in the [pam] section
   • SSSD ssh responder: ca_db in the [ssh] section

   For details, see man page for sssd.conf.

   Red Hat recommends keeping the default path and using a dedicated Certificate Authority certificate file for SSSD to make sure that only Certificate Authorities trusted for authentication are listed here.

Procedure

1. Create a new directory for SSH keys in the home directory of the user who uses smart card authentication:

   # mkdir /home/<example_user>/.ssh

2. Run the ssh-keygen -D command with the opensc library to retrieve the existing public key paired with the private key on the smart card, and add it to the authorized_keys list of the user’s SSH keys directory to enable SSH access with smart card authentication.

   # ssh-keygen -D /usr/lib64/pkcs11/opensc-pkcs11.so >> ~<example_user>/.ssh/authorized_keys

3. SSH requires access right configuration for the /.ssh directory and the authorized_keys file. To set or change the access rights, enter:

   # chown -R <example_user:example_user> ~<example_user>/.ssh/

   # chmod 700 ~<example_user>/.ssh/

   # chmod 600 ~<example_user>/.ssh/authorized_keys

Verification

1. Display the keys:

   # cat ~<example_user>/.ssh/authorized_keys

   The terminal displays the keys.

2. Verify the SSH access with the following command:

   # ssh -I /usr/lib64/opensc-pkcs11.so -l <example_user> localhost hostname

Procedure

1. Create a certificate mapping configuration file, such as /etc/sssd/conf.d/sssd_certmap.conf.

2. Add certificate mapping rules to the sssd_certmap.conf file:

   [certmap/shadowutils/otheruser]
   matchrule = <SUBJECT>.CN=certificate_user.<ISSUER>^CN=Example Test CA,OU=Example Test,O=EXAMPLE$

   Note that you must define each certificate mapping rule in separate sections. Define each section as follows:

   [certmap/<DOMAIN_NAME>/<RULE_NAME>]

   If SSSD is configured to use the proxy provider to allow smart card authentication for local users instead of AD, IPA, or LDAP, the <RULE_NAME> can simply be the username of the user with the card matching the data provided in the matchrule.