Yubico Forum

Re: macOS Login enforce PIV

2016-10-13T17:53:51+01:00

We can see the smart card ecoystem slowly growing in macOS (following the beta builds very closely here and testing as they are released). If you're familiar with previous builds, smart card support has been essentially non-existent for the past several yearly releases.

My recommendation continues to be use PAM/challenge-response until the ecosystem expands (if you need two-factor for login) - combining with a complex FileVault password is a pretty solid combination. I'm currently playing with both right now (PIV and PAM concurrently), but I wouldn't recommend on a production system at this time.

Statistics: Posted by ChrisHalos — Thu Oct 13, 2016 5:53 pm

Re: macOS Login enforce PIV

2016-10-13T13:53:45+01:00

Thanks Chris.

sc_auth was what I was missing. It's really frustrating that macOS doesn't have better smart card support. It is also really annoying that there isn't anyway to get FDE setup with MFA, I've seen some good methods on Linux, too bad we can't get access to the preboot environment. Ah well.

ChrisHalos wrote:

Removing PIV - delete the certificates on the card (or reset the applet) with PIV Manager, then remove the hashes with sc_auth:

viewtopic.php?t=2434&p=9037

No, it's not possible to force it right now (I've seen hacks that kind of work, but so far it has been very inconsistent and all methods end up breaking some functionality in macOS). FileVault, sudo in Terminal, and Security & Privacy section of System Preferences all currently don't support smart cards. Until these issues are cleared up in Sierra, I wouldn't recommend attempting to force a smart card requirement.

Statistics: Posted by bmorgenthaler — Thu Oct 13, 2016 1:53 pm

Re: macOS Login enforce PIV

2016-10-10T00:25:20+01:00

Statistics: Posted by ChrisHalos — Mon Oct 10, 2016 12:25 am

macOS Login enforce PIV

2016-10-07T23:38:11+01:00

As someone mentioned in another thread the macOS PIV setup with Yubikey doesn't appear to force the yubikey to be present. Not talking about the initial FileVault encryption but screen saver unlock. If I have my nano it, it requires the PIN. If I remove the nano however it allows me to login with my password.

So then:

Is it possible to enforce the Yubikey to be in place to unlock?
What is the proper way to remove the PIV setup so I can go back to PAM

Statistics: Posted by bmorgenthaler — Fri Oct 07, 2016 11:38 pm