Linux, - USB- JaCarta PKI . PAM- , Kerberos- Linux , . Astra Linux Astra Linux Directory (ALD) .
, . , .
Astra Linux Directory (ALD) JaCarta PKI
Astra Linux Directory (ALD) ( ) .
ALD LDAP, Kerberos5, Samba/CIFS :
- ;
- Kerberos5;
- , Samba/CIFS;
- UNIX, LDAP, Kerberos, Samba, PAM;
- LDAP Kerberos;
- LDAP Kerberos ;
- , , Web-, .
JaCarta PKI PKI- ,
...
Astra Linux Directory (ALD) JaCarta PKI ALD . , , , , : , , Web-, MS Windows. VDI , , VmWare Citrix.
-
- Astra Linux Smolensk SE 1.5 4.2.0-23-generic, x86_64, :
- JaCarta IDProtect 6.37;
- libccid;
- pcscd;
- libpcsclite1;
- krb5-pkinit;
- libengine-pkcs11-openssl;
- opensc.
- Astra Linux Smolensk SE 1.5 4.2.0-23-generic, x86_64, :
- JaCarta IDProtect 6.37;
- libccid;
- pcscd;
- libpcsclite1;
- krb5-pkinit.
, ALD , , , .
-
JaCarta PKI :
libccid, pcscd, libpcsclite1.
IDProtectClient, ...
- Kerberos
ald/kerberos krb5-pkinit .
JaCarta PKI libengine-pkcs11-openssl opensc.
(CA) OpenSSL.
OpenSSL SSL/TLS. RSA, DH, DSA X.509, , CSR CRT.
EXAMPLE.RU. , EXAMPLE.RU, kdc, client. , . .
- CA mkdir /etc/ssl/CA . .
- CA:
$ openssl genrsa -out cakey.pem 2048
$ openssl req -key cakey.pem -new -x509 days 365 -out cacert.pem
. Common name EXAMPLE.RU.
- KDC:
$ openssl genrsa -out kdckey.pem 2048
$ openssl req -new -out kdc.req -key kdckey.pem
. Common name kdc.
- . .
export REALM=EXAMPLE.RU
export CLIENT=kdc
- pkinit_extensions http://dms.aladdin-rd.ru/970c5538-afbf-4a26-a7ef-d76550cbc435
pkinit_extensions ( , ):
[ kdc_cert ]
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
#Pkinit EKU
extendedKeyUsage = 1.3.6.1.5.2.3.5
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
# Copy subject details
issuerAltName=issuer:copy
# Add id-pkinit-san (pkinit subjectAlternativeName)
subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
[kdc_princ_name]
realm = EXP:0, GeneralString:${ENV::REALM}
principal_name = EXP:1, SEQUENCE:kdc_principal_seq
[kdc_principal_seq]
name_type = EXP:0, INTEGER:1
name_string = EXP:1, SEQUENCE:kdc_principals
[kdc_principals]
princ1 = GeneralString:krbtgt
princ2 = GeneralString:${ENV::REALM}
[ client_cert ]
# These extensions are added when 'ca' signs a request.
basicConstraints=CA:FALSE
keyUsage = digitalSignature, keyEncipherment, keyAgreement
extendedKeyUsage = 1.3.6.1.5.2.3.4
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:princ_name
# Copy subject details
issuerAltName=issuer:copy
[princ_name]
realm = EXP:0, GeneralString:${ENV::REALM}
principal_name = EXP:1, SEQUENCE:principal_seq
[principal_seq]
name_type = EXP:0, INTEGER:1
name_string = EXP:1, SEQUENCE:principals
[principals]
princ1 = GeneralString:${ENV::CLIENT}
- KDC:
$ openssl x509 -req -in kdc.req -CAkey cakey.pem -CA cacert.pem -out kdc.pem -extfile pkinit_extensions -extensions kdc_cert CAcreateserial days 365
- kdc.pem, kdckey.pem, cacert.pem /var/lib/krb5kdc/
- /etc/krb5kdc/kdc.conf. /etc/krb5kdc/kdc.conf, [kdcdefaults] :
pkinit_identity = FILE:/var/lib/krb5kdc/kdc.pem,/var/lib/krb5kdc/kdckey.pem
pkinit_anchors = FILE:/var/lib/krb5kdc/cacert.pem
, .
- :
/etc/init.d/krb5-admin-server restart
/etc/init.d/krb5-kdc restart
-.
,
libengine-pkcs11-openssl opensc. , .
, PIN- . , JaCarta PKI .
pkcs11-tool.
pkcs11-tool --slot 0 --init-token --so-pin 00000000 --label 'JaCarta PKI' --module /lib64/libASEP11.so,
:
--slot 0 , . , 0, 1,2 ..;
--init-token ;
--so-pin 00000000 PIN- JaCarta PKI. 00000000;
--label 'JaCarta PKI' ;
--module /lib64/libASEP11.so libASEP11.so. idprotectclient . .
PIN- :
pkcs11-tool --slot 0 --init-pin --so-pin 00000000 --login --pin 11111111 --module /lib64/libASEP11.so,
:
--slot 0 , . , 0, 1,2 ..;
--init-pin PIN- ;
--so-pin 00000000 PIN- JaCarta PKI. 00000000;
--login ;
--pin 11111111 PIN- ;
--module /lib64/libASEP11.so libASEP11.so. idprotectclient . .
, :
pkcs11-tool --slot 0 --login --pin 11111111 --keypairgen --key-type rsa:2048 --id 42 --label test1 key --module /lib64/libASEP11.so,
:
--slot 0 , . , 0, 1,2 ..;
--login --pin 11111111 , PIN- 11111111. PIN- , ;
--keypairgen --key-type rsa:2048 , 2048 ;
--id 42 CKA_ID . CKA_ID ;
! .
--label test1 key CKA_LABEL . ;
--module /lib64/libASEP11.so libASEP11.so. idprotectclient . .
openssl. :
#openssl
OpenSSL> engine dynamic -pre SO_PATH:/usr/lib/ssl/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/lib64/libASEP11.so
OpenSSL> req -engine pkcs11 -new -key 0:42 -keyform engine -out client.req -subj "/C=RU/ST=Moscow/L=Moscow/O=Aladdin/OU=dev/CN=test1 (!_!)/emailAddress=test1@mail.com"
OpenSSL>quit.
-new -key 0:42,
0 ,
42 CKA_ID .
, , "/C=RU/ST=Moscow/L=Moscow/O=Aladdin/OU=dev/CN=test1 (! _!)/emailAddress=test1@mail.com".
$ export REALM=EXAMPLE.RU #
$ export CLIENT=test1 #
.
$ openssl x509 -CAkey cakey.pem -CA cacert.pem -req -in client.req -extensions client_cert -extfile pkinit_extensions -out client.pem days 365
PEM DER.
# openssl x509 -in client.pem -out client.cer -inform PEM -outform DER
.
pkcs11-tool --slot 0 --login --pin 11111111 --write-object client.cer --type 'cert' --label 'Certificate' --id 42 --module /lib/libASEP11.so,
:
--slot 0 , . , 0, 1,2 ..;
--login --pin 11111111 , PIN- 11111111. PIN- , ;
--write-object ./client.cer , ;
--type 'cert' , ;
'cert' --label 'Certificate' CKA_LABEL . ;
--
id 42 CKA_ID . CKA_ID, ;
--
module /lib64/libASEP11.so libASEP11.so.
.
/etc/krb5/.
/etc/krb5/ CA
(cacert.pem) c .
kerberos /etc/krb5.conf. [libdefaults] .
[libdefaults]
default_realm = EXAMPLE.RU
pkinit_anchors = FILE:/etc/krb5/cacert.pem
#
pkinit_identities = PKCS11:/lib64/libASEP11.so
:
kinit PIN- , .
, kerberos- , klist. kdestroy.
- PIN- -.
. , , login -, , , .
shuralev
12:37
