You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by "Van Deman, Quint CTR US USJFCOM J7" <qu...@att.jfcom.mil> on 2008/03/27 20:10:21 UTC
svn client & smartcard certificates
Hi all-
I asked this question of the users list back on March 5th and haven't
gotten any responses.
Perhaps someone here might have some insight, any information would be
appreciated.
I'm working on standing up a subversion server for a US DoD command.
As such, one of the requirements is that the repository be protected
with US DoD PKI (a.k.a CAC cards).
The apache/webdav portion of this configuration was very
straightforward, but both testing & documentation leads me to believe
that while client certificates are supported in the svn client, version
1.4 can only access certs in a PKCS#12 file stored on the client's
filesystem.
In searching through the mailing lists there seem to be some rough
indications that basic smartcard support will be available in 1.5, can
anyone confirm this?
We have the cards working with firefox via pcscd & coolkey, but the svn
client is obviously our ultimate goal.
If such support will be there in 1.5 can anyone confirm if it also
exists in 1.5-alpha2?
Thanks,
Quint
__________________________________________________
Quint (Frank) Van Deman
frank.vandeman@att.jfcom.mil
757-203-5893
RE: svn client & smartcard certificates
Posted by "Van Deman, Quint CTR US USJFCOM J7" <qu...@att.jfcom.mil>.
Thank you both for the information.
I will certainly respond back to the users@ list with our progress.
I also apologize for hitting the dev@ list...but I should note that I
did try users first & didn't get any responses...that aside, my
apologizes for the lack of list etiquette...
Thanks,
Quint
-----Original Message-----
From: Joe Orton [mailto:jorton@redhat.com]
Sent: Friday, March 28, 2008 5:27 AM
To: Van Deman, Quint CTR US USJFCOM J7
Cc: users@subversion.tigris.org
Subject: Re: svn client & smartcard certificates
Per Karl's mail, following up to users@.
On Thu, Mar 27, 2008 at 04:10:21PM -0400, Van Deman, Quint CTR US
USJFCOM J7 wrote:
> I asked this question of the users list back on March 5th and haven't
> gotten any responses. Perhaps someone here might have some insight,
> any information would be appreciated.
>
> I'm working on standing up a subversion server for a US DoD command.
> As such, one of the requirements is that the repository be protected
> with US DoD PKI (a.k.a CAC cards).
...and also yes, the code for using smartcards is present in the
Subversion alpha2 tarball. The current code is indeed pretty basic, as
you say; I'm not sure how the CAC cards are set up so I'm not sure
whether they will work.
Notably: if you have multiple tokens made available by the PKCS#11
provider, or a token with multiple client cert/key pairs, neon will
simply pick the first token/keypair it finds. This can be improved.
Getting it working requires some effort; you need all of:
1) pakchois from http://www.manyfish.co.uk/pakchois/, set up to find the
PKCS#11 provider(s) of choice
2) GnuTLS 2.x from http://www.gnu.org/software/gnutls/
3) neon 0.28.x built against both the above
4) Subversion built against that neon 0.28.x install
So, for example, if you have the CoolKey PKCS#11 provider installed at
/usr/lib/pkcs11/libcoolkeypk11.so, then you would do this:
1) Build pakchois:
./configure --enable-module-path=/usr/lib/pkcs11
--prefix=/usr/local/pkcs11
make && make install
*** very important that pakchois is configured to look in the right
directory for PKCS#11 provider loadable modules ***
2) Build GnuTLS 2.x:
./configure --prefix=/usr/local/pkcs11
make && make install
3) Build neon 0.28.2:
./configure --prefix=/usr/local/pkcs11 --enable-shared \
--with-libs=/usr/local/pkcs11 --with-ssl=gnutls
*** check for this line in the configure output: ***
configure: using pakchois for PKCS11 support
*** if not present, neon will not have PKCS#11 support ***
make && make install
4) Build Subversion 1.5.0 alpha2:
./configure --with-neon=/usr/local/pkcs11
This should result in a Subversion build with working PKCS#11 support.
To configure use of the CoolKey provider, you'd then need to add:
ssl-pkcs11-provider = coolkey
at the appropriate place in ~/.subversion/servers. You could add it in
the [global] section to use it for all servers, or e.g. to use it for
all *.mil servers:
[groups]
cac = *.mil
[cac]
ssl-pkcs11-provider = coolkey
That should be it. When you try to use an SSL server which requests a
client cert, you should get prompted for the smartcard PIN.
I'd be very interested in hearing about whether this works for the CAC
card - let me know if you have problems, or any questions/feedback.
Regards,
joe
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: svn client & smartcard certificates
Posted by Joe Orton <jo...@redhat.com>.
Per Karl's mail, following up to users@.
On Thu, Mar 27, 2008 at 04:10:21PM -0400, Van Deman, Quint CTR US USJFCOM J7 wrote:
> I asked this question of the users list back on March 5th and haven't
> gotten any responses. Perhaps someone here might have some insight,
> any information would be appreciated.
>
> I'm working on standing up a subversion server for a US DoD command.
> As such, one of the requirements is that the repository be protected
> with US DoD PKI (a.k.a CAC cards).
...and also yes, the code for using smartcards is present in the
Subversion alpha2 tarball. The current code is indeed pretty basic, as
you say; I'm not sure how the CAC cards are set up so I'm not sure
whether they will work.
Notably: if you have multiple tokens made available by the PKCS#11
provider, or a token with multiple client cert/key pairs, neon will
simply pick the first token/keypair it finds. This can be improved.
Getting it working requires some effort; you need all of:
1) pakchois from http://www.manyfish.co.uk/pakchois/, set up to find the
PKCS#11 provider(s) of choice
2) GnuTLS 2.x from http://www.gnu.org/software/gnutls/
3) neon 0.28.x built against both the above
4) Subversion built against that neon 0.28.x install
So, for example, if you have the CoolKey PKCS#11 provider installed at
/usr/lib/pkcs11/libcoolkeypk11.so, then you would do this:
1) Build pakchois:
./configure --enable-module-path=/usr/lib/pkcs11 --prefix=/usr/local/pkcs11
make && make install
*** very important that pakchois is configured to look in the right
directory for PKCS#11 provider loadable modules ***
2) Build GnuTLS 2.x:
./configure --prefix=/usr/local/pkcs11
make && make install
3) Build neon 0.28.2:
./configure --prefix=/usr/local/pkcs11 --enable-shared \
--with-libs=/usr/local/pkcs11 --with-ssl=gnutls
*** check for this line in the configure output: ***
configure: using pakchois for PKCS11 support
*** if not present, neon will not have PKCS#11 support ***
make && make install
4) Build Subversion 1.5.0 alpha2:
./configure --with-neon=/usr/local/pkcs11
This should result in a Subversion build with working PKCS#11 support.
To configure use of the CoolKey provider, you'd then need to add:
ssl-pkcs11-provider = coolkey
at the appropriate place in ~/.subversion/servers. You could add it in
the [global] section to use it for all servers, or e.g. to use it for
all *.mil servers:
[groups]
cac = *.mil
[cac]
ssl-pkcs11-provider = coolkey
That should be it. When you try to use an SSL server which requests a
client cert, you should get prompted for the smartcard PIN.
I'd be very interested in hearing about whether this works for the CAC
card - let me know if you have problems, or any questions/feedback.
Regards,
joe
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: svn client & smartcard certificates
Posted by Karl Fogel <kf...@red-bean.com>.
"Van Deman, Quint CTR US USJFCOM J7" <qu...@att.jfcom.mil> writes:
> In searching through the mailing lists there seem to be some rough
> indications that basic smartcard support will be available in 1.5, can
> anyone confirm this?
>
> We have the cards working with firefox via pcscd & coolkey, but the svn
> client is obviously our ultimate goal.
>
> If such support will be there in 1.5 can anyone confirm if it also
> exists in 1.5-alpha2?
1.5.0 (and its prereleases) should support PKCS#11-provided (smartcard)
SSL client certs if you build your client to use the Neon HTTP library.
See http://svn.collab.net/viewvc/svn?view=rev&revision=29421 for
details. I don't know much about smartcard support myself, by the way,
I'm just quoting from http://svn.collab.net/repos/svn/trunk/CHANGES (I
searched for "smartcard" in that file).
Please take any followup to users@subversion.tigris.org, as we try to
reserve the dev@ list for development of Subversion only. That is, even
though it is likely that some people here on dev@ can answer technical
questions about Subversion, this is not a forum they joined for that
purpose. We're not 100% strict about this, as you can see, which is why
I'm happy to answer your question (as best I can). But please keep any
follow up off the dev@ list, unless it has to do with the development of
Subversion (e.g., you find a bug in the smartcard support or something).
Thanks, and good luck,
-Karl
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org