Replace the contents of '/etc/pam.d/login' with the following:Īuth optional pam_mount.so try_first_passĪuth required pam_opendirectory. Make a backup of the PAM LOGIN settings using the following command: And, you must remove any Identity Preferences for the websites as it will then automatically select the certificate that is attached with the Identity Preference.

If the text that returns does not include the line, 'auth sufficient pam_smartcard.so' at the TOP of the listing, this is a finding. If it isnt blinking when it should be selecting a cert, then it isnt seeing the card reader.

# cat /etc/pam.d/login | grep -i pam_smartcard.so To verify that the 'login' command has been configured to require smart card authentication, run the following command: Security-related parameters include, for example: registry settings account, file, directory permission settings and settings for functions, ports, protocols, services, and remote connections.Īpple macOS 11 (Big Sur) Security Technical Implementation Guideĭetails Check Text ( C-33784r591639_chk )įor systems that are not utilizing smart card authentication, this is Not Applicable. This makes it possible to use a YubiKey with PIV support for. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. macOS support mandatory use of a smart card, which disables all password-based authentication. Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.Ĭonfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system.

Macos smart card