Setup guide

UNCLASSIFIED

Chapter 2 -

Intro to Mac OS X Security

manage the multitude of credentials and certificates that a user must maintain.

Multiple keychains can be set up for a single user, each protected by a different

credential such as a passphrase. All items stored in a keychain are encrypted, and

can only be viewed as plaintext after authentication. Each keychain can have a

different usage configuration, such as requiring the user to re-authenticate every

time a credential in the keychain is used, or automatically unlocking a keychain

when upon login so that all its credentials can be accessed automatically by

applications. Each item in a keychain retains a unique Access Control List (ACL) that

specifies applications authorized to access it. Certificates can be managed using a

keychain and this can be used in conjunction with e-mail applications to enable a

user to digitally sign messages. If configured correctly, keychains can be a useful tool

for managing user credentials.

Security Support for Applications

The Keychain Access application provides a user-friendly interface that allows

storage of secure keys, passwords, and certificates for use with Mail and Safari, as

well as other applications. Importing a certificate, for example, is a point and click

operation. This allows users to easily configure their computer for encrypted

network transmissions, enhancing the security of e-mail and web applications.

Smart Cards

Mac OS X provides the ability to use Department of Defense Common Access Cards,

or Federal Smart Cards, for user authentication. This guide does not contain

instructions for using Smart Cards for authentication. Guidance of this nature is

planned for future versions.

Apple provides the “Apple Federal Smart Card Package Installation and Setup

Guide” (

http://docs.info.apple.com/article.html?artnum=25526

) which provides

guidance on setting up and using this capability in Mac OS X v10.2.3 – v10.2.8.

Apple is currently developing a comprehensive guide for Smart Card usage in Mac

OS X v10.3.x. Users interested in taking advantage of the Smart Card capability in

Mac OS X should refer to the Apple guidance as listed above. Detailed help for this

capability is available from the Help menu while running the Common Access Card

Viewer application.