Dec 15

US Army has an App for that – US Army News & Information

App Store, Apple, Army, DOD, iPhone, ipod touch | No Comments »

689843The Official Homepage of the United States Army now on the iPhone!

All of the news from Army.mil can now be carried with you. Read the latest articles, view the newest pictures, and watch the latest videos direct from your iPhone. Save your favorite stories to the phone for offline viewing. Share news with your friends via email, Twitter and Facebook.

Features:
- Test your skills with a challenging tile strategy game.
- Keep up to date with the latest Army Tweets and the US Army Facebook page.
- Download Army Podcasts direct to your device.
- Learn about Army Ranks, Equipment, Uniforms, and the Army song.
- Browse Stand-To! and the Army Live blog.
- Download and read Soldiers Magazine.
- Find a recruiter.

Customize the App so your favorite sections are always quickly available.

The US Army App works on both the iPhone and iPod touch and requires iPhone OS 3.0 or later.

689843 689843_2
689843_3689843_4
689843_5

written by AppleMacGenius \\ tags: , , , , ,

Sep 15

Enabling CAC login and creating FileVault CAC user in 10.5

Apple, Army, CAC, DOD, Security | 2 Comments »

CacLoginThese steps to enable Smart Card or in the DOD space Common Access Card or CAC  have been around since 10.4.  The steps that follow are for two different things.  The first is to Enable CAC login on your Macintosh.  The second set of steps is to enable a FileVaulted user with CAC.  You will be using the Termal for both of these so if you are not familiar with Terminal I suggest you do not use it.  It is safe to install a successfully modified /etc/authorization to enable smart card login on any client system, even those without smart card readers. If no reader or card is present, the user will continue to see the default login window, and there will be no performance impact.  To support login with a smart card on Mac OS X 10.5/10.6, the card must support signing with a public key. In addition, the card itself must have a plugin, known as a tokend, that can communicate with securityd and the card itself.

Smart cards and Directory Services

Part of the login process is to do a lookup for the expected user in a directory service such as Open Directory, LDAP, or Active Directory. The first and recommended method to link a smart card user with a record in a directory service is to add the hash of the public key to the user’s directory record. This is the most convenient and most secure way of identifying a smart card user.  The second method is to lookup the user based on values drawn from the email signing certificate as required for the US Federal Government smart card use.

A script is preinstalled to assist you in binding a smart card to a user’s local directory domain record. This is /usr/sbin/sc_auth:

myhostname#  /usr/sbin/sc_auth -h
Usage:  sc_auth accept [-v] [-u user] [-k keyname] # by key on inserted card(s)

sc_auth accept [-v] [-u user] -h hash # by known pubkey hash
sc_auth remove [-v] [-u user] # remove all public keys for this user
sc_auth hash [-k keyname] # print hashes for keys on inserted card(s)

An example of the output from this for a US Department of Defense Common Access Card is:

myhostname% sc_auth hash
01C2F20D8964BE7701B57B63B0A1795B8F2604C1 Identity Private Key
443F30C356E676F447CD4DA89F46CC0CCED19737 Email Signing Private Key
4845564C1F8C6B378C19B8F262CE422933CF1FD1 Email Encryption Private Key

To add a user to the local directory

myhostname% sudo sc_auth accept -u myuser -h 01C2F20D8964BE7701B57B63B0A1795B8F2604C1

…where “01C2F20D8964BE7701B57B63B0A1795B8F2604C1″ is the hash for the key associated with the Identity Private Key.  Refer to the script for further usage instructions. You will need to run this as a user authorized to modify the directory.  In this example, any of the hash entries listed could have been used for associating the card to the account.  If desired, more than one smart card can be associated with a single user account by running the script again with the hash from the additional card(s).

The script adds a field to the user’s authentication_authority property. For example, after executing the command above, the authentication_authority property for the user looks like:

myhostname% dscl . -read /Users/myuser

“authentication_authority” = ( “;ShadowHash;”, “;pubkeyhash;
01C2F20D8964BE7701B57B63B0A1795B8F2604C1″ );

One can immediately log in to a new session using the smart card.

Smart card login uses Open Directory for all of its user lookups, so any supported directory structure will function properly.

Enabling FileVault

1. Enable FileVault Master password

2. Use tokenadmin to create a FileVault User
$ tokenadmin create-fv-user -u <user> -l”<UserName.”-p <password>
(the  {-p <password>} is optional)

3. Display available public key hash(es) from Smart Card
$ sc_auth hash

4. Bind Smart card to user account with public key hash
$ sc_auth accept -u <user> -h <hash>

5. Mount FileVault image file
$ hdiutil attach /Users/<user>/<user>.sparsebundle

6. Set User’s login Keychain to unlock with Smart Card
$ systemkeychain -T /Volumes/<user>/Library/keychains/login.keychain

7.  Unmount FileVault image file
$ hdiutil unmount /Users/<user>

Note: Right now under Snow Leopard these steps fail.  I am working with Apple to figure out the solution.  Check back soon.

Caveats and Recommendations – Things to keep in mind when deploying

You Must:
Create a NEW FileVault account
Have a Smart Card with an Encryption Key

You Should:
Ensure access to system via a second Admin Account
Escrow the Encryption Key for recovery
Securely Erase FREE Space afterwards via Disk Utility or srm

To support login with a smart card on Mac OS X 10.4, the card must support signing with a public key. In addition, the card itself must have a plugin, known as a tokend, that can communicate with securityd and the card itself.

written by AppleMacGenius \\ tags: , , , , , , , ,

Oct 06

Army eyes civilian gadgets for military use

Apple, Army, DOD, Mac OS X, Mobile, iPhone | No Comments »


By Jim Tice - Staff writer Posted : Saturday Oct 4, 2008 10:40:46 EDT

FORT BELVOIR, Va. — The proliferation of trendy mobile communication devices in the civilian sector has prompted the Army to take a close look at them for a variety of possible military applications.

Service officials estimate there are 80,000 mobile devices operating in Army cyberspace for official business — about half of them purchased and owned by the government.

The remaining 40,000 are owned by soldiers and Army civilian employees who use them for a combination of official and personal communications, on installations and in remote combat zones.

“They have become very important in the Army workplace,” said Lt. Col. C. J. Wallington, director of Advanced Technologies for the Army’s Chief Information Office/G-6.

Even without official Army endorsement, soldiers are finding ways to use these increasingly versatile devices for military missions.

Sgt. 1st Class Larry Williams, an infantryman who is mentor for the Afghan army’s counter-narcotics infantry battalion in Helmand Province, said he regularly uses a cell phone on local Afghan networks to call home and communicate with members of his team.

However, that is not an ideal situation, most importantly because the military communication gear they are using “drowns out our cell phones,” Williams said.

“And, the problem with iPhones or Blackberries controlling weapons of war is that it would take a soldier’s eyes off the battle and put his focus on the device in his hands,” he said.

Master Sgt. Jerry Glesmann, a member of the same counternarcotics team, uses two cell phones — one for personal calls and text messages, and the other for communicating with members of his team.

He cited concerns about having a secure network when using an iPhone or Blackberry, “otherwise you’ll lose a lot of operational ability.”

Glesmann said if he had access to a secure network, he probably would use it for e-mail and text messaging.

The Army has much bigger plans than that, and no product has caught the attention of its information technology specialists like the iPhone, the multipurpose Apple product introduced in 2007 that has become a worldwide bestseller.

The device, measuring less than ½-inch thick, and about 2 ½ inches high by 4 ½ inches long, can be used for multiple applications, including phone communications, e-mail, Web browsing, as an iPod, as a navigational aid with Global Positioning System access, as a camera and photo storage device, and as a high-tech calendar and calculator.

“The iPhone has tremendous potential as a mobile device for the Army because it really is a computer platform that happens to have a phone in it,” Wallington said.

One Army vendor, iRobot, has seen an application developed for the iPhone to control its PackBot, a lightweight tactical mobile robot capable of performing such dangerous battlefield missions as explosive ordnance reconnaissance, identification and disposal.

Wallington said the same iPhone capability that serves as a control device for digital games can be used to steer and drive the robot.

“What we have to do now is secure the communications link between iPhone and PackBot,” Wallington said.

Competing devices with similar, but not exact, capabilities are starting to enter the market, like the Samsung Instinct and HTC Touch Diamond available through Sprint.

Because these devices are multi-purpose computers, officials see vast potential for military applications.

For example, they could be used by EOD soldiers to analyze and neutralize ordnance, by aviators for filing and using flight data and maps, by medical personnel for monitoring case histories, and as a storage and high-tech retrieval devices for all manner of field and technical manuals.

A unique aspect of iPhone is that it cannot be used with a normal stylus, because the touch screen only reacts to the texture of the user’s finger.

That creates a potential problem for the Army because soldiers in the field and crewmembers in aircraft and fighting vehicles frequently wear gloves.

However, a stylus with a special tip has been developed that should eliminate that problem, officials say.

Jonathan Broskey, the Apple program lead for the Army, noted that the iPhone has very good graphics that have been found adaptable for viewing and manipulating medical images in the treatment of tissue, organ and bone injuries.

Despite its potential, iPhone has not yet been approved for Army use, although it is being tested by the service for email applications.

As currently configured, iPhone does not have the ability to read Common Access Cards (CACs), a minimum Defense Department requirement for signing in and encrypting messages.

For the past three years, the Army’s chief information officer – first Lt. Gen. Stephen W. Boutelle, and now Lt. Gen. Jeffrey A. Sorenson – have embraced a product diversity strategy in overseeing the acquisition of information technology equipment.

The goal is to promote competition by authorizing Army organizations to do business with a variety of manufacturers.

“This is particularly important in the area of mobile products, because competition does one of two things,” Wallington said.

“First, manufacturers either make their products more attractive to the Army by lowering prices or adding features – that’s a good thing for soldiers.

“Second, it makes the Army harder to attack by adding different operating systems. An attack that may work against one system may not work against another,” he said.

Until recently, Blackberry products from Research in Motion (RIM) were the only mobile devices with secure messaging features approved for Army communications.

Two companies that offer similar capabilities for devices that use Microsoft Windows, Apriva Sensa Mail and Good Mobile Messaging, recently were placed on the approved list.

A particularly attractive feature of these products for the Army is their ability to interact with CAC readers for secure access, just like the desk top computers in facilities throughout the Army.

And, because Windows mobile devices can be used with most mobile service providers, this gives the Army, and individual soldiers, greater choice in the marketplace.

Blackberry devices are proprietary, which means they must be used in conjunction with servers running Blackberry software in order to be secure in the Army.

Tim Smeltzer estimates that among the 80,000 mobile devices operating in Army space, there are Blackberries and 20 to 30 different products using Windows. Smeltzer is the Senior Solutions Architect for mobile devices in the Advanced Technologies office of CIO/G-6.

Six to eight of those products are “smart phones” with touch screen for entering data, like iPhone. The remaining devices have touch keys, buttons or scroll wheels for entering data, he said.

Army officials also are seeing the emergence of special mobile devices developed for the National Security Agency’s Secure Mobile Environment Portable Electronic Device Program.

SME PED products, one just introduced by General Dynamics and another on the way from L-3 Communications Systems, can provide a top secret level of security for voice communication, and secret and lower for email and Websites.

Wallington said the devices have the capability to easily move between secure and non-secure modes.

Another newly introduced product, Celio Redfly, is a mobile terminal about half the size of a laptop computer that connects wirelessly, or with a USB tether, to the user’s mobile device.

The terminal, called a “mobile companion,” essentially is a keyboard and screen that can be used to view the mobile device’s operating system, and for sending and receiving messages, and for connecting to the Internet.

Officials say the device has potential for multiple uses, such as a terminal that could be used by units for easily downloading mission plans and other info into the mobile devices of their soldiers.

“It is not so much what the manufacturer provides to the Army, but how our user community adapts to what is available,” Wallington said.

written by AppleMacGenius \\ tags: , , , , ,