Common Access Card

[Kenneth Penland]

There is a big push to use a Common Access Card for all authentication needs. I tried finding any reference to using smartcards for login to HPUX 11i machines, but I guess I am stumped on if it would even be at the UNIX level or the application on the windows side that is used to log in. Has anyone else had to deal with this issue and have any advice on how to do away with "passwords" completely?

[Tim Nelson]

Did you look at "PAM" Plugable Authentication Modules ? HPUX fully supports.

Somewhere there has to be a "trust" as you are accessing the server via the network vs a physical means like a hardwired terminal.

[Kenneth Penland]

well, in doing a man on pam_authenticate I see:

The authentication can be done through a smart card. In this case the
user plugs their smart card in the smart card reader and is required
to enter their smart card PIN.

so I guess I see it is possible, just not sure how to implement. at least this gives me a direction to focus my google searches.

[Kenneth Penland]

still not getting it....I guess I am expected to add an entry into the pam_user.conf file, (and eventually into the pam.conf file for everyone) however, how does this work with our client piece that we use to SSH into the box? I don't see any authentication method for smart card in that, do I have to find an app that supports SSH and smartcard on the other end to get this to work?