Supported Applications - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 43. Securing Your Network
underlying authentication and authorization mechanisms so that users can log in to Red Hat
Enterprise Linux from the log-in screen, and then not need to re-enter their passwords. These
applications are detailed below.
In addition, users can log in to their machines even when there is no network (offline mode) or where
network connectivity is unreliable, for example, wireless access. In the latter case, services will
degrade gracefully.

43.3.1.1. Supported Applications

The following applications are currently supported by the unified log-in scheme in Red Hat Enterprise
Linux:
• Login
• Screensaver
• Firefox and Thunderbird
43.3.1.2. Supported Authentication Mechanisms
Red Hat Enterprise Linux currently supports the following authentication mechanisms:
• Kerberos name/password login
• Smart card/PIN login
43.3.1.3. Supported Smart Cards
Red Hat Enterprise Linux has been tested with the Cyberflex e-gate card and reader, but any card that
complies with both Java card 2.1.1 and Global Platform 2.0.1 specifications should operate correctly,
as should any reader that is supported by PCSC-lite.
Red Hat Enterprise Linux has also been tested with Common Access Cards (CAC). The supported
reader for CAC is the SCM SCR 331 USB Reader.
As of Red Hat Enterprise Linux 5.2, Gemalto smart cards (Cyberflex Access 64k v2, standard with
DER SHA1 value configured as in PKCSI v2.1) are now supported. These smart cards now use
readers compliant with Chip/Smart Card Interface Devices (CCID).
43.3.1.4. Advantages of Red Hat Enterprise Linux Single Sign-on
Numerous security mechanisms currently exist that utilize a large number of protocols and credential
stores. Examples include SSL, SSH, IPsec, and Kerberos. Red Hat Enterprise Linux SSO aims to
unify these schemes to support the requirements listed above. This does not mean replacing Kerberos
with X.509v3 certificates, but rather uniting them to reduce the burden on both system users and the
administrators who manage them.
To achieve this goal, Red Hat Enterprise Linux:
• Provides a single, shared instance of the NSS crypto libraries on each operating system.
• Ships the Certificate System's Enterprise Security Client (ESC) with the base operating system.
The ESC application monitors smart card insertion events. If it detects that the user has inserted
636