HP (Hewlett-Packard) t5720 manual

Impleme nting A cti vIdentity Smar t Car ds f or U se w ith HP C ompaq t5 7 20 Thin C li ents and HP Blade P Cs Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

2 Intr oduction Smart cards can str engthen user authen tication in a cor por ate networ k b y offe ring str ong, 2 -factor a uthen- ticati on to offse t weak pas s w or ds or cumbe rsome a uthenticati on polic ies r equir ing fr equent pas s wo rd changes . T his paper pr ov ides instructi ons f or confi guring a smart car d w ith y our HP Compaq [...]

3 • Citr ix Pr esent ation Serv er 4 w ith Hotfi x Rollup P ac k PSE4 00W2KR01 f or Citr ix Pr esent ation Server 4. 0 for Windo ws 2000 Server . •F a t c l i e n t s : - Client (W indo w s 2000/XP): MetaFr ame Pr esenta ti on Server C lient P ac k ager 8.1, Pr ogr am Neighbor hood Clas sic componen t. - Citr ix Pr esentati on Server Cli ent P [...]

4 • Smart Card R eaders • HP standar d USB Smart Car d K ey boar d . Go to http://w ww .hp.com fo r dri ver support avail- able w ith sp3113 7 .e xe (dr i v er 4. 30. 0.1) or greater . Dri ver : HPKBCC ID .s ys , v ersi on 4. 30. 0.1. • USB CA C appr ov ed smar t card r eader (SCM Mi cr osy stems SCR3 31 Reader ). Dri ver : S CR3 3X2K .s y s,[...]

5 Cli ent So ft w ar e Conf igur ation Installing A cti vClient PK I Only The S etup Deplo yment c h apter o f the Res our ce K it pr o vi ded b y Acti vI dentity disc usse s ho w to deploy Acti vClient u sing standar d methods . The A cti vCli ent PKI Onl y 6 . 0 allo w s the user (bas ed on pr iv ileges) or the Administr ator to change and v er- [...]

6 As mentioned a bov e, the f irst ins tallati on step is to mo dify the thin cli ent’s RAMDisk si z e fr om defa ult set- tings to 64 MB . Mak e note o f the defa ult setting so th at it can be r estor ed af te r installati on is complete . T o change RAMDisk si z e, c lic k Start > Control P anel > HP RAMDisk M anager . Ne xt, modify the [...]

7 Once the env ironmental v ari ables hav e been changed, r ight-clic k on the EWF i con on the taskbar and select Commi t . NO TE : T he env ironmental v ar iables should be c hanged bac k to de fault se ttings after installation pac k age has been installed , and then the wr ite filter change s mus t again be committed. Installation o f Acti vCli[...]

8 Initiali zing the smart card Use the f ollo w ing procedur e on blank smart cards or car ds whic h contain a standalone pr of ile that need to be r e -initiali z ed. T o initiali z e your P IN using the P IN Initiali z ation T ool: 1. Go to Start > Programs > ActivIdentity > Ac tivClient and select PIN Initialization Tool . -or - R ight-[...]

9 Ser ver Soft war e Conf iguration Installing M ic ro soft C ertifi cate Serv ice s R ole based administr ati v e featur es included in Wind ow s Ser v er 2003 can be u sed to manage and main- tain digital certif icates v ia the Certificati on A uthor ity (CA). The CA can be used b y a user o r administr ator to pr o v ision a smart car d . T o in[...]

10 4. Click Cert ific ate S ervic es , and then clic k Ne xt . 5. Select Enterpris e Root CA , and then c lic k Ne xt .[...]

11 6. Click Ye s to accept the w arning . 7. Ty p e a Common name for this CA , and then clic k Ne xt .[...]

12 8. Select Ne x t to accept Certif icate Databas e Settings . The ins tallation w ill configur e components , as sho wn in the f ollo wing sc r een .[...]

13 9. Click Ye s w hen pr ompted to temporar ily stop IS S. 10. Click Fini sh to complete the installatio n. Conf igur ing a Ce rtifi cate A uthor it y (CA ) serv ice Conf igur e a CA service . This white pa per uses Mi c r os oft Cer ti ficat e Se r vices t o c onfig ure c er ti ficat es. Refe r to “Installing Mic roso ft Certificate Ser vices?[...]

14 3. Cr eate a duplicat e template b y ri ght-clic king on the Smartcard L ogon certifi cate template , and then select ing Duplicate T emplate . 4. T ype a name fo r the new te mplate in the Te m p l a t e D i s p l a y n a m e box . F or this ex ample we w ill use the temp late nam e of CCI Sma rtcard User . This te mplate w ill be re fer r ed t[...]

15 5. Click t he Request Hand ling tab. 6. Select 10 2 4 in the Minimum ke y size box . 7. Click t he CSP s button. 8. Select Requests can use any CSP available on t he subjec t ’s compu ter . 9. Click t he Security tab.[...]

16 10. In the P ermis sions for Authentica ted Users ar ea , in the Allo w column, selec t both Rea d and Enroll. Y ou hav e cr eated the cr eati on of the templat e. 11. Copy t he CCI SmartCar d User certifi cate template into the Cert ific ate s T emplates folder under the certific ate server . a. Expand the Cer tificate Aut hority object in the [...]

17 d. S el e ct Ne w > Certificate Template to Is sue. 12. Selec t the template , and then clic k OK to import the template.[...]

18 Conf igur ing Mi cr oso ft Certifi cate A uthor ity to Issue Smart Car d User C ertifi- cate Acti vClient 6 . 0 PKI Serv ices support Digital certif i cate- based logon t o Windo ws 2000, Windo ws XP Pr o- fes sional , and W indo w s Server 200 3 . The Servi ces also su pport: • The a bility to log off use r and lock w or kstati on on smart ca[...]

19 2. Expand the def ined CA. 3. Rig h t - cl ic k Certifi cate T emplat es , and then select Ne w . a. S el e ct Certifica te T emp late to I ssue . b . Selec t Enrollment Agent. c. S el ect OK to add. 4. Launc h Internet Explor er and bro w se to http://localhost/certsr v .[...]

20 5. Under Select a task , select Request a cer tifica te . 6. Select advanced certificate request.[...]

21 7. Select Create and submit req uest to th is CA . 8. In the Cert ifi cate T emplat es bo x, s elect Enr ollment Ag ent.[...]

22 9. V erify Enr ollment A gent Settings in the Key O pt i on s section as follo ws: • Create new k e y is selected • Mic roso ft Enhanced Cryptogr aphic Pr ov ider v1. 0 •C l i c k Submit . 10. Accept def ault se ttings under Additional O ptions . 11. If a war ning message dis play s about a potenti al sc ript ing v iolation , press Y es to[...]

23 12. Install the Enr ollment certificate r eques ted. 13. Select Ye s to P o tent ial Scrip tion Violat ion. Y ou hav e succes sfull y gener ated and inst alled r equ ir ed Enr ollment Certif icate , as show n belo w .[...]

24 Manuall y issue Smart Car d User C ertifi cate 1. Launc h Internet Explor er and bro w se to http://localhost/certsr v . 2. Select Reque st a ce rtificate . 3. Select advanced certificate request.[...]

25 4. Select Request a cer tificate for a smar t card on behalf of anoth er user b y using t he smart card cer tificate enrollment s tation. 5. Select Smartcard User under Enrollment O ptions .[...]

26 6. Def ine the user to enr oll by c lic king Select User . NO TE : Ac tivC lient L ibr ar ies ma y r eport a container err or message w hen used f or sec ur e logon purpo ses. It is important that the ser v ers Ac ti ve Dir ector y User infor mation cont ain an e -mail addr ess on an y smar t car d pr ov isioned with a smart car d user certifi c[...]

27 7. Inser t Smar t Card into Reader , and then select Enr oll . Smart Car d V alidati on T esting the Smart Car d T o ver if y that the CCI SmartCar d L ogon certific ate fo r the user is ins talled on the smart car d: 1. Cli ck t he ActivCard icon in t he sy stem tray to open the Ac tivClient user consol e . 2. In the ri ght pane , select the M [...]

28 3. Select the u sername ID to v ie w the installed certificate , whic h sho w s: • who it w as issued to • who is w as issued by • vali d dates T roubleshoot A cti vClient The T rouble shooting Wi z ar d helps y ou sol ve an y problems w ith Acti vClient . It analyz es y our sy stem , diag- nose s the pr oblems, and then displa ys the r es[...]

29 The f ollo wing table lis ts what ac tions t o tak e ne xt if y ou do not type y our PIN or the T r oubleshooting Wi z ard is displa y ed: 5. When the Anal ysis in Pr ogr ess page is displa y ed , cli ck Ne xt . 6. If pr oblems ar e detected , then the Problems f ound page is displa y ed . Clic k Ne xt . The Di agnosis and R esoluti ons page is [...]

30 • Manage the smart cards and certifi cates us ed w ith Acti vClient PKI Onl y 6 . 0 L ibr ari es • Use A cti vCli ent PK I Only 6 .0 L ibr ar ies to log o n/o ff and lock/unloc k y our W indo w s 2000, XP wo rk- stati on , Windo ws 2000 and 2003 S ervers . • Use a di gital certificate t o impr ov e e -mail sec urity and bro wse sec ur e w [...]

31 Usage cases Usage cas e 1: User a uthenti cation f r om HP blade PC to A cti ve Dir ector y Domain The f ollo wing step s pr ov ide instruc tions f or perf orming a f unctional te st of the SmartCar d Logo n certifi cate (assumes A cti vClient PKI Onl y 6 . 0 libr ari es ha ve been dis tributed t o clie nt blade PC s): 1. Ensur e the CCI blade i[...]

32 Usage ca se 2 : User authen ticati on f r om c lie nt de v ice to blade P C or Ac ti v e Dir ect ory Server using RDP The f ollo wing steps pr ov ides instr ucti ons fo r performing a f uncti onal test of the SmartCar d L ogon certifi- cate: 1. Log out o f the RDP session . 2. Open the Remot e Desktop Co mmunicati ons w indo w and initiate a con[...]

33 The f ollo w ing steps pro vide ins truc tions f or perfor ming a func tional te st of the C CI SmartCard L ogon cer tif- icat e: 1. Log out o f the MS RDP sessi on . 2. Open the HP S AM c lient w indo w and initiat e a co nnectio n to the HP blade P C or Acti ve Dir ectory Server . 3. Mak e sur e a smart card is installed in the r eader . The s[...]

34 Usage cas e 4: Acce ssing sec ur e W eb site Sec ur e W eb access means access to an y W eb se rver w ith SSL v3 and a digit al certificate . The f ollo wing steps pr ov ide instru ctions f or accessing a secur e W eb site using an A cti vI dentity smar t car d thr ough an HP blade P C or Acti ve Dir ectory Server . Installing and confi guring a[...]

35 Usage ca se 5: Us er authenti c ati on using VPN thr ough fir ew all to HP blade PC o r A ct ive D i rec to r y S er ver Instruc tions f or installing and conf igur ing a VPN tunnel w ith a fir ew all is be y ond the scope of this w hite paper ; ther efor e , the w hite paper assume s the VPN tunnel and fir ewall ar e alread y installed and f un[...]

36 8. Select Add a shortc ut for this conn ection to my desktop , and then cli ck Fini sh . Depending upon the conf igur ation o f the VPN tunnel, y ou may hav e to change the confi gur ation of the VPN connectio n. T o change the conf igur ation o f the VPN w indo w: 1. In Contr ol P anel, open Net w ork and Internet C onnections > Netwo rk Co [...]

37 2. Rig h t - cl ic k on t h e VPN connection icon and select Pr operties . Y ou can initiate the VPN connecti on after se tting it up , as fo llo ws: 1. Start the VPN connecti on . 2. In Smar t card PIN , type the P IN , and then cli ck OK . While est ablishing the VPN connecti on , the s ys tem displa y s Verifying username and password and Aut[...]

38 After the connecti on is est ablished , the networ k connectio n icon displa y s in the s y stem tr a y . Usage cas e 6: User a uthenticati on f r om c lient de vi ce using C itri x server A single cli ent can access m ultiple Ci tri x servers in the same ses sion , with Ac tivC lient r unning on each C it- ri x server . Supported Citr ix authen[...]

39 3. Select pr operties for the ICA connec tion , c lic k the Logon Information tab, select Smar t card , and then cli ck OK . 4. Double -cli c k the shortcut t o connect to the C itri x server . 5. During logon t o the server , the smar t car d login pr ompt appear s fo r author iz ation .[...]

40 Acr o ny ms ACM —Adapti v e Cr edential Manager . CA —Certifi cate Au thority . CAC —E ither Common Acce ss Car d (for U . S. go vernment) or C orpor ate Access Car d (for enterprise s ystems) . CSP — Cry pto g r aph i c S erv ice P r ov i de r . FIPS —F eder al Infor mation Pr ocessing Standar d . GP —GlobalP latfor m . Replaces Ope[...]

41 Serv i ce and Support If y ou wo uld lik e additional inf or mation about A cti vCli ent or other Acti vI dentity pr oducts, plea se r ef er to http://w ww .ac tiv identity .com . F or support issue s, y ou ma y contact y our local Acti vIdentity res eller , or Acti vI dentity cu stomer support b y email at support @actividentity .com . Acti vId[...]