jacobfinton / posix_cac

A script to help configure DOD Smart Cards (Common Access Card (CAC)).

POSIX_CAC

Introduction

This is an alternative to linux_cac that allows for the configuration of a Common Access Card (CAC). This script avoids bashisms to conform to the POSIX standard. The script gives the option for several different PKCS11 modules. opensc is the recommended module as it is actively maintained and supported on more systems.

• All imported certificates are the most recent from the Official DOD PKI Website.

Warning Currently snap packaged browsers do not support adding PKCS11 modules (Ex. Firefox on Ubuntu). If the script sees you are currently using a snap browser it will not continue. This can be fixed by removing that package and installing a non snap version of your browser (Install Firefox on Linux).

Usage

1. Download smartcard.sh
2. sudo ./smartcard.sh
3. Choose the options that work best for your system.

Supported Systems

Package Managers: (apt, pacman, yum, dnf, zypper)

Distribution	Versions	Browsers	PKCS11 Modules
Debian	11	Firefox, Chrome	opensc
Ubuntu	18.04 LTS	Firefox, Chrome	opensc, cackey
	20.04 LTS	Firefox, Chrome	opensc, cackey
	22.04 LTS	Firefox(Non Snap), Chrome	opensc
Manjaro	22.0+	Firefox, Chrome	opensc
Fedora	37.0+	Firefox, Chrome	opensc
openSUSE	Tumbleweed	Firefox, Chrome	opensc, coolkey, cackey

Contribute

Code contributions are welcome! Please commit any pull requests against the main branch.

References

• https://public.cyber.mil/pki-pke/
• https://pubs.opengroup.org/onlinepubs/9699919799/utilities/contents.html
• https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/modutil/index.html
• https://github.com/jdjaxon/linux_cac
• https://en.opensuse.org/DoD_Common_Access_Card_(CAC)_Reader
• https://wiki.archlinux.org/title/Smartcards
• https://militarycac.com/linux.htm

posix_cac's Issues

Adding and Deleting PKCS11 Modules using modutil

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
Update the script to use modutil instead of printf on pkcs11.txt files. This will make the codebase smaller and would allow a user to change pkcs modules much easier.

Describe alternatives you've considered

• https://firefox-source-docs.mozilla.org/security/nss/index.html
• https://docs.oracle.com/cd/E19879-01/820-4335/ablrf/index.html

Additional context
Ensure that your web service is taken offline (stopped, disabled, etc.) while performing these steps and ensure no concurrent access to the NSS database by other processes (such as a browser). Doing so may corrupt the NSS database or result in improper usage of these certificates.