How To: Setup DOD Common Access Card (CAC) for service portals

[Sgt-Slyde]

RESOLVED

Evidently it's simply a problem with the coolkey library not being able to interrupt the new 144k cards. Our fine DoD fellows have the solution:
<https://software.forge.mil/sf/frs/do....cackey.0_5_12>

Simply get the RPM or DEB or SRC from there (CAC required, ironically) - install and within Firefox or Thunderbird or whatever, point to the .so file that the package installed and... viola!

Still trying to figure out how to get that working with the gnome-keyring and gnome smart card manager... but that's another project for another day I suppose.

FYI, Fedora has some updated source RPM's... I think I try that too, I've heard that the latest coolkey supports the new cards as well. Anyway...

Cheers.

--ponga

Thanks, ponga! That worked fine - just went in out at work and downloaded the rpm file from software.forge and copied the .so file into my pkcs11 folder and now it's reading my GEMALTO 144 card like a champ!

[darkdragn]

Compiled the latest release of coolkey source, with about 7 extra patches, all put out by fedora (Mainly ripped from their source rpm, up to date as of 28 SEP 2010). This is working perfectly for me, so far i've tested it with a DOD issued cac, using ActivIdentity usb reader v3, ubuntu 10.04, on a i386 environment. If anyone thinks this would be easier than the other option (Or without this you cannot access the alternate option considering it requires a cac, lol) you are free to use it. For some reason i couldn't attach it as a .deb, so i just gzip tarred the debs.

[shambotics]

Thanks to mole84 for the tut and to ponga for the fix. I'm one step closer to never having to boot in to windows again.

[sgtlake]

Ok i have a similar problem. Im trying to get my scr 3310 to read.. i got to your tutorial and it was helpful but i think my problem lies where pcsc saves the smartcard.text file its looking for it in the following location

Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
NONE
I am able to get the latest text file by clicking the link but i cant save it in the above location due to permission faults.

Any ideas?

Thanks
Pt make it hurt

[windowsh8r]

I got my CAC card working fine on everything except webmail. When I go to AF portal, I can select between the email certificate and the regular one, but when I try to access my base's webmail it says that it requires authentication without even asking for a certificate.

I found that these instructions worked great for installing the driver and getting firefox to recognize it. Except my base's webmail, which does work through windows XP.

http://www.hrgeeks.com/2008/11/21/us...u-and-firefox/

[sgtlake]

Has anyone successfully gotten this to work with Ubuntu Jaunty 64-bit?

I've installed the required packages--no problem there. And pcsc_scan says everything's fine.

But when I try to load the security module libcoolkeypk11.so, Firefox "freezes" and stops responding. If I insert and remove the CAC a few times it will come back to life.

But then if I try to access an https:// site, things don't work. It will attempt to connect to the site for a minute or two, then (sometimes) eventually ask for my master password, but entering the pin has yet to actually get me into a site.

I get the same basic result with both Firefox 3.0 and Firefox 3.5.

My card reader is an SCR3310 v2.0.

Any ideas?

Im having the exact same problem. Im thinking its the card reader. As soon as i put my id card in reader firefox closes. works fine without reader plugged in.

[spaznrq]

I got my CAC card working fine on everything except webmail. When I go to AF portal, I can select between the email certificate and the regular one, but when I try to access my base's webmail it says that it requires authentication without even asking for a certificate.

I found that these instructions worked great for installing the driver and getting firefox to recognize it. Except my base's webmail, which does work through windows XP.

http://www.hrgeeks.com/2008/11/21/us...u-and-firefox/

I also have issues with webmail, but I think it may be different than yours. I actually got webmail working earlier today, but now, it's asking me to enter my "master password" (pin) multiple times over and over and over again. Then it never brings me to my inbox. I have a feeling my CAC is locked so I'll have to check on a Windows machine...

I'm hoping what I did earlier today to make it work would help you, but I'm not exactly sure how I can help... btw, using Ubuntu 10.10 here.

[lingenfr]

I am back at work today, so I downloaded the deb and the src. Has anyone used these on 64-bit 10.10? If I don't hear back, I will try the deb and see if it throws an error.

[lingenfr]

Ok i have a similar problem. Im trying to get my scr 3310 to read.. i got to your tutorial and it was helpful but i think my problem lies where pcsc saves the smartcard.text file its looking for it in the following location

Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
NONE
I am able to get the latest text file by clicking the link but i cant save it in the above location due to permission faults.

Any ideas?

Thanks
Pt make it hurt

gksudo nautilus
(enter your password)

I expect the downloaded file is in your home directory. You should be able to copy it to the /usr/share/pcsc folder now.

[Sgt-Slyde]

lingenfr, I've used it on 10.10 and it's worked fine. The install script wouldn't run but I was able the "un-zip" the RPM file and manually copy the libcackey.so into the /usr/lib64/pkcs11 directory.