7.5. Configuring smart card authentication with lock on removal

• with-smartcard — enabling smart card authentication
• with-smartcard-required — enabling exclusive smart card authentication (authentication with a password is disabled)

• with-smartcard-lock-on-removal — enforcing log out after the smart card removal

  注意

  The with-smartcard-lock-on-removal option only works on systems with the GNOME desktop environment. If you are using a system that is tty or console based and you remove your smart card from its reader, you are not automatically locked out of the system.

Prerequisites

• Smart card contains your certificate and private key.
• The card is inserted into the reader and connected to the computer.
• The authselect tool is installed on your local system.

Procedure

• Enter the following command to enable smart card authentication, disable password authentication, and enforce lock on removal:

  # authselect select sssd with-smartcard with-smartcard-required with-smartcard-lock-on-removal --force

  Now, when you remove the card, the screen locks. You must re-insert your smart card to unlock it.