Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

6.2. Enabling Smart Card Login

Smart card login for Red Hat Enterprise Linux servers and workstations is not enabled by default and must be enabled in the system settings.

Note

Using single sign-on when logging into Red Hat Enterprise Linux requires these packages:
  • nss-tools
  • esc
  • pam_pkcs11
  • coolkey
  • ccid
  • gdm
  • authconfig
  • authconfig-gtk
  • krb5-libs
  • krb5-workstation
  • krb5-auth-dialog
  • krb5-pkinit-openssl
  1. Log into the system as root.
  2. Download the root CA certificates for the network in base 64 format, and install them on the server. The certificates are installed in the appropriate system database using the certutil command. For example: 
    # certutil -A -d /etc/pki/nssdb -n "root CA cert" -t "CT,C,C" -i /tmp/ca_cert.crt
    Copy to Clipboard Toggle word wrap
  3. In the top menu, select the System menu, select Administration, and then click Authentication.
  4. Open the Advanced Options tab.
  5. Click the Enable Smart Card Support checkbox.
  6. When the button is active, click Configure smart card ....
    There are two behaviors that can be configured for smart cards:
    • The Require smart card for login checkbox requires smart cards and essentially disables Kerberos password authentication for logging into the system. Do not select this until after you have successfully logged in using a smart card.
    • The Card removal action menu sets the response that the system takes if the smart card is removed during an active session. Ignore means that the system continues functioning as normal if the smart card is removed, while Lock immediately locks the screen.
  7. By default, the mechanisms to check whether a certificate has been revoked (Online Certificate Status Protocol, or OCSP, responses) are disabled. To validate whether a certificate has been revoked before its expiration period, enable OCSP checking by adding the ocsp_on option to the cert_policy directive.
    1. Open the pam_pkcs11.conf file. 
      vim /etc/pam_pkcs11/pam_pkcs11.conf
      Copy to Clipboard Toggle word wrap
    2. Change every cert_policy line so that it contains the ocsp_on option. 
      cert_policy = ca, ocsp_on, signature;
      Copy to Clipboard Toggle word wrap

      Note

      Because of the way the file is parsed, there must be a space between cert_policy and the equals sign. Otherwise, parsing the parameter fails.
  8. If the smart card has not yet been enrolled (set up with personal certificates and keys), enroll the smart card, as described in Section 5.3, “Enrolling a Smart Card Automatically”.
  9. If the smart card is a CAC card, the PAM modules used for smart card login must be configured to recognize the specific CAC card.
    1. As root, create a file called /etc/pam_pkcs11/cn_map.
    2. Add the following entry to the cn_map file: 
      MY.CAC_CN.123454 -> login
      Copy to Clipboard Toggle word wrap
      MY.CAC_CN.123454 is the common name on the CAC card and login is the Red Hat Enterprise Linux login ID.

Note

When a smart card is inserted, the pklogin_finder tool (in debug mode) first maps the login ID to the certificates on the card and then attempts to output information about the validity of certificates. 
pklogin_finder debug
Copy to Clipboard Toggle word wrap
This is useful for diagnosing any problems with using the smart card to log into the system.
맨 위로 이동
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2025 Red Hat