Chapter 7. Configuring smart card authentication using authselect

• The authselect tool is installed on your system

  The authselect tool configures user authentication on Linux hosts and you can use it to configure smart card authentication parameters. For details about authselect, see Configuring user authentication using authselect.

• Supported Smart Card or USB devices.

  For details, see Smart Card support in RHEL.

• Active Directory (AD)

• Identity Management (IdM)

  For details about how to create IdM certificates, see Requesting a new user certificate and exporting it to the client.

• Red Hat Certificate System (RHCS)

  For details, see Managing Smart Cards with the Enterprise Security Client.

• Third-party Certification Authority (CA)
• Local Certification Authority. You can use a certificate generated by the Local Certification Authority if the user is not part of a domain or for testing purposes.

Prerequisites

• The Smart card contains your certificate and private key.
• The card is inserted into the reader and connected to the computer.
• The authselect tool is installed on your system.

Procedure

• Enter the following command to allow smart card and password authentication:

  # authselect select sssd with-smartcard --force

  Copy to Clipboard Toggle word wrap

  At this point, smart card authentication is enabled, however, password authentication will work if you forget your smart card at home.

• with-smartcard — enables smart card authentication in addition to password authentication
• with-smartcard-required  — enables smart card authentication and disables password authentication

Prerequisites

• Smart card contains your certificate and private key.
• The card is inserted into the reader and connected to the computer.
• The authselect tool is installed on your local system.

Procedure

• Enter the following command to enforce smart card authentication:

  # authselect select sssd with-smartcard with-smartcard-required --force

  Copy to Clipboard Toggle word wrap
  Note

  Once you run this command, password authentication will no longer work and you can only log in with a smart card. Ensure smart card authentication is working before running this command or you may be locked out of your system.

• with-smartcard — enabling smart card authentication
• with-smartcard-required — enabling exclusive smart card authentication (authentication with a password is disabled)

• with-smartcard-lock-on-removal — enforcing log out after the smart card removal

  Note

  The with-smartcard-lock-on-removal option only works on systems with the GNOME desktop environment. If you are using a system that is tty or console based and you remove your smart card from its reader, you are not automatically locked out of the system.

Prerequisites

• Smart card contains your certificate and private key.
• The card is inserted into the reader and connected to the computer.
• The authselect tool is installed on your local system.

Procedure

• Enter the following command to enable smart card authentication, disable password authentication, and enforce lock on removal:

  # authselect select sssd with-smartcard with-smartcard-required with-smartcard-lock-on-removal --force

  Copy to Clipboard Toggle word wrap

  Now, when you remove the card, the screen locks. You must re-insert your smart card to unlock it.