智能卡
You can use a smart card connected to the client device for authentication when logging on to a Linux virtual desktop session. This feature is implemented through smart card redirection over the ICA smart card virtual channel. You can also use the smart card within the session. Use cases include:
- Adding a digital signature to a document
- Encrypting or decrypting an email
- Authenticating to a website
The Linux VDA uses the same configuration as the Windows VDA for this feature. For more information, see theConfigure the smart card environmentsection in this article.
Note:
Using a mapped smart card within a Linux VDA session to sign on to Citrix Gateway isn’t supported.
Prerequisites
The availability of smart card pass-through authentication is contingent on the following conditions:
Your Linux VDA is installed on one of the following distributions:
- RHEL 9.2/9.0
- RHEL 8.8/8.6
- RHEL 7, CentOS 7
- Rocky Linux 9.2/9.0
- Rocky Linux 8.8/8.6
- Ubuntu 22.04
- Ubuntu 20.04
- Debian 11.3
完成安装的共识后,确认your VDA can register with the Delivery Controller and you can open the published Linux desktop sessions using Windows credentials.
智能卡supported by OpenSC are used. For more information, seeEnsure that OpenSC supports your smart card.
Citrix Workspace app for Windows is used.
Ensure that OpenSC supports your smart card
OpenSC is a widely used smart card driver on RHEL 7.4+. As a fully compatible replacement of CoolKey, OpenSC supports many types of smart cards (seeSmart Card Support in Red Hat Enterprise Linux).
In this article, the YubiKey smart card is used as an example to illustrate the configuration. YubiKey is an all-in-one USB CCID PIV device that can easily be purchased from Amazon or other retail vendors. The OpenSC driver supports YubiKey.
If your organization requires some other more advanced smart card, prepare a physical machine with a supported Linux distribution and the OpenSC package installed. For information about the OpenSC installation, seeInstall the smart card driver. Insert your smart card, and run the following command to verify that OpenSC supports your smart card:
pkcs11-tool --module opensc-pkcs11.so --list-slots
Configuration
Prepare a root certificate
A root certificate is used to verify the certificate on the smart card. Complete the following steps to download and install a root certificate.
Get a root certificate in PEM format, typically from your CA server.
You can run a command similar to the following to convert a DER file (*.crt, *.cer, *.der) to PEM. In the following command example,certnew.ceris a DER file.
openssl x509 -inform der -in certnew.cer -out certnew.pem
Install the root certificate to the
openssl
directory. Thecertnew.pemfile is used as an example.cp certnew.pem
To create a path for installing the root certificate, run
sudo mdkir -p
.
Build the pam_krb5 module on RHEL 8.x/9.x and Rocky Linux 8.x/9.x
Smart card authentication depends on the pam_krb5 module, which is deprecated on RHEL 8.x and Rocky Linux 8.x. The following steps are required if you want to use smart card authentication on RHEL 8.x and Rocky Linux 8.x machines delivered in multi-session OS mode. For smart card authentication on RHEL 8.x and Rocky Linux 8.x machines delivered in single-session OS (VDI) mode, you can skip the following steps.
Download the pam_krb5-2.4.8-6 source code fromhttps://centos.pkgs.org/7/centos-x86_64/pam_krb5-2.4.8-6.el7.x86_64.rpm.html.
Build and install the pam_krb5 module on RHEL 8.x and Rocky Linux 8.x.
yum install -y opensc pcsc-lite pcsc-lite-libs pcsc-lite-ccid nss-tools yum install gcc krb5-devel pam-devel autoconf libtool rpm2cpio pam_krb5-2.4.8-6.el7.src.rpm | cpio –div tar xvzf pam_krb5-2.4.8.tar.gz cd pam_krb5-2.4.8 ./configure --prefix=/usr make make install
Verify that pam_krb5.so exists under /usr/lib64/security/.
ls -l /usr/lib64/security | grep pam_krb5
Configure the smart card environment
You can use the ctxsmartlogon.sh script to configure the smart card environment or complete the configuration manually.
(Option 1) Use the ctxsmartlogon.sh script to configure the smart card environment
Note:
The ctxsmartlogon.sh script adds PKINIT information to the default realm. You can change this setting through the/etc/krb5.confconfiguration file.
在使用smart cards for the first time, run the ctxsmartlogon.sh script to configure the smart card environment.
Tip:
If you have used SSSD for domain joining, restart the SSSD service after you run ctxsmartlogon.sh.
sudo /opt/Citrix/VDA/sbin/ctxsmartlogon.sh
The results resemble the following:
You can also disable smart cards by running the ctxsmartlogon.sh script:
sudo /opt/Citrix/VDA/sbin/ctxsmartlogon.sh
The results resemble the following:
(Option 2) configure the smart card environment manually
The Linux VDA uses the same smart card environment with the Windows VDA. In the environment, multiple components must be configured, including the Domain Controller, Microsoft Certificate Authority (CA), Internet Information Services, Citrix StoreFront, and Citrix Workspace app. For information about the configuration based on the YubiKey smart card, see Knowledge Center articleCTX206156.
Before moving to the next step, make sure that:
- You have configured all components correctly.
- You have downloaded the private key and user certificate to the smart card.
- You can successfully log on to the VDA using the smart card.
Install the PC/SC Lite packages
PCSC Lite is an implementation of the Personal Computer/Smart Card (PC/SC) specification in Linux. It provides a Windows smart card interface for communicating to smart cards and readers. Smart card redirection in the Linux VDA is implemented on the PC/SC level.
Run the following command to install the PC/SC Lite packages:
RHEL 9.2/9.0/8.x, Rocky Linux 9.2/9.0/8.x, RHEL 7/CentOS 7:
yum install pcsc-lite pcsc-lite-ccid pcsc-lite-libs
Ubuntu 22.04, Ubuntu 20.04, Debian 11.3:
apt-get install -y libpcsclite1 libccid
Install the smart card driver
OpenSC is a widely used smart card driver. If OpenSC is not installed, run the following command to install it:
RHEL 9.2/9.0/8.x, Rocky Linux 9.2/9.0/8.x, RHEL 7/CentOS 7:
yum install opensc
Ubuntu 22.04, Ubuntu 20.04, Debian 11.3:
apt-get install -y opensc
Install the PAM modules for smart card authentication
Run the following command to install the pam_krb5 and krb5-pkinit modules.
RHEL 7/CentOS 7:
yum install pam_krb5 krb5-pkinit
RHEL 9.2/9.0/8.x, Rocky Linux 9.2/9.0/8.x:
yum install krb5-pkinit
Ubuntu 22.04, Ubuntu 20.04:
apt-get install libpam-krb5 krb5-pkinit
Debian 11.3:
apt-get install -y libpam-krb5 krb5-pkinit
The pam_krb5 module is a pluggable authentication module. PAM-aware applications can use pam_krb5 to check passwords and obtain ticket-granting tickets from the Key Distribution Center (KDC). The krb5-pkinit module contains the PKINIT plug-in that allows clients to obtain initial credentials from the KDC using a private key and a certificate.
Configure the pam_krb5 module
The pam_krb5 module interacts with the KDC to get Kerberos tickets using certificates in the smart card. To enable pam_krb5 authentication in PAM, run the following command:
authconfig --enablekrb5 --update
In the/etc/krb5.confconfiguration file, add PKINIT information according to the actual realm.
Note:
Thepkinit_cert_match选项指定匹配规则,客户端certificate must match before it is used to attempt PKINIT authentication. The syntax of the matching rules is:
[relation-operator] component-rule …
whererelation-operatorcan be either&&, meaning all component rules must match, or||, meaning only one component rule must match.
Here is an example of a generic krb5.conf file:
EXAMPLE.COM = { kdc = KDC.EXAMPLE.COM auth_to_local = RULE:[1:$1@$0] pkinit_anchors = FILE:/certnew.pem pkinit_kdc_hostname = KDC.EXAMPLE.COM pkinit_cert_match = ||msScLogin,digitalSignature pkinit_eku_checking = kpServerAuth }
The configuration file resembles the following after you add the PKINIT information.
Configure PAM authentication
PAM configuration files tell what modules are used for PAM authentication. To add pam_krb5 as an authentication module, add the following line to the/etc/pam.d/smartcard-authfile:
auth [success=done ignore=ignore default=die] pam_krb5.so preauth_options=X509_user_identity=PKCS11:
The configuration file resembles the following after modification if SSSD is used.
(Optional) Single sign-on by using smart cards
Single sign-on (SSO) is a Citrix feature that implements pass-through authentication with virtual desktop and application launches. This feature reduces the number of times that users type their PIN. To use SSO with the Linux VDA, configure Citrix Workspace app. The configuration is the same with the Windows VDA. For more information, see Knowledge Center articleCTX133982.
Enable the smart card authentication as follows when configuring the group policy in Citrix Workspace app.
Fast smart card logon
Fast smart card is an improvement over the existing HDX PC/SC-based smart card redirection. It improves performance when smart cards are used in high-latency WAN environments. For more information, see智能卡.
The Linux VDA supports fast smart card on the following versions of Citrix Workspace app:
- Citrix Receiver for Windows 4.12
- Citrix Workspace app 1808 for Windows and later
Enable fast smart card logon on the client
Fast smart card logon is enabled by default on the VDA and disabled by default on the client. On the client, to enable fast smart card logon, include the following parameter in the default.ica file of the associated StoreFront site:
[WFClient] SmartCardCryptographicRedirection=On
Disable fast smart card logon on the client
To disable fast smart card logon on the client, remove theSmartCardCryptographicRedirectionparameter from the default.ica file of the associated StoreFront site.
RunXDPing
After completing the preceding steps, you can use the LinuxXDPingtool to check for common configuration issues that might exist in your Linux VDA environment. For more information, seeXDPing.
Usage
Log on to the Linux VDA by using a smart card
You can use a smart card to log on to the Linux VDA in both SSO and non-SSO scenarios.
- In the SSO scenario, you are logged on to StoreFront automatically by using the cached smart card certificate and PIN. When you launch a Linux virtual desktop session in StoreFront, the PIN is passed to the Linux VDA for smart card authentication.
In the non-SSO scenario, you are prompted to select a certificate and type a PIN to log on to StoreFront.
当你启动Linux虚拟桌面会话StoreFront, a dialog box for logon to the Linux VDA appears as follows. The user name is extracted from the certificate in the smart card and you must type the PIN again for logon authentication.
This behavior is the same with the Windows VDA.
Reconnect to a session by using a smart card
To reconnect to a session, ensure that the smart card is connected to the client device. Otherwise, a gray caching window appears on the Linux VDA side and exits quickly because reauthentication fails without the smart card connected. No other prompt is provided in this case to remind you to connect the smart card.
On the StoreFront side, however, if a smart card is not connected when you reconnect to a session, the StoreFront web might give an alert as follows:
Limitation
Support for limited Linux distributions and AD integration methods
Smart card pass-through authentication supports limited Linux distributions and AD integration methods. See the following matrix:
Winbind SSSD Centrify Debian 11.3 Yes Yes Yes RHEL 9.2/9.0 Yes Yes No RHEL 8.8/8.6 Yes Yes Yes RHEL 7.9, CentOS 7.9 Yes Yes Yes Rocky Linux 9.2/9.0 Yes Yes No Rocky Linux 8.8/8.6 Yes Yes No Ubuntu 22.04/20.04 Yes Yes Yes
Smart card removal policy
Now, the Linux VDA uses only the default behavior for smart card removal. When you remove the smart card after logging on to the Linux VDA successfully, the session remains connected and the session screen is not locked.
Support for other smartcards and the PKCS#11 library
Citrix provides a generic smart card redirection solution. Although only the OpenSC smart card is listed on our support list, you can try using other smart cards and the PKCS#11 library. To switch to your specific smart card or the PKCS#11 library:
Replace all the
opensc-pkcs11.so
instances with your PKCS#11 library.To set the path of your PKCS#11 library to the registry, run the following command:
/opt/Citrix/VDA/bin/ctxreg update -k "HKLM\System\CurrentControlSet\Control\Citrix\VirtualChannels\Scard" -v "PKCS11LibPath" -d "PATH"
where路径points to your PKCS#11 library such as /usr/lib64/pkcs11/opensc-pkcs11.so
Disable fast smart card logon on the client.