Government sign-in
Three settings for government and defense networks. All are off until an admin turns them on, so nothing changes for anyone who does not need them.
Sign-in notice
Administration > Settings > Sign-in notice and marking banner, Sign-in notice:
- DoD Notice and Consent Banner: DoD's Standard Mandatory Notice and Consent Banner, word for word.
- Your own text: your agency's or company's notice (plain text, up to 4,000 characters).
The notice shows before anyone signs in. Until they choose I agree, the sign-in form, single sign-on and smart card sign-in stay disabled. It shows again on every visit to the sign-in page, including after signing out.
Marking banner
Marking banner puts a line across the top and bottom of every page: the Gardience pages, the Salt view and the sign-in page. Choose UNCLASSIFIED, CUI, CONFIDENTIAL, SECRET, TOP SECRET or TOP SECRET//SCI in their standard colors, or Other text (for example CUI//SP-PRVCY) with a color. The POA&M download uses the same marking in its header.
Smart card sign-in (CAC / PIV)
People sign in with their CAC or PIV card instead of a password. The card's certificate is checked against the certificate authorities you trust and for revocation, then matched to the Gardience user you link it to. The card and its PIN are the two factors.
1. On the server
sudo /opt/gardience/gardience cac on --dod--dod downloads DoD's certificate authorities from DISA (unclass-certificates_pkcs7_DoD.zip) and checks the bundle against DISA's own checksums before using it. Other options:
| Option | Effect |
|---|---|
--ca FILE | Trust these certificate authorities instead (PEM, PKCS#7 or DER), for example the Federal PKI for PIV cards, or DoD's bundle downloaded elsewhere on a network without internet. Include the intermediate authorities. |
--crl FILE | Check cards against revocation lists (PEM or DER). The file must hold the list of every authority that issues your cards (DoD has many): a card whose authority has no list in the file is refused. Replace it later with gardience cac crl FILE, for example from cron. |
--no-ocsp / --ocsp | Revocation by OCSP (asking the authority's responder at sign-in) is on by default. Turn it off on a network without internet and use --crl. The choice is kept. |
--port N | The smart card port, 8445 by default. |
It opens a second HTTPS port (8445) where the server asks for a card. Only people who choose smart card sign-in go there, so nobody else is asked for a certificate. Open TCP 8445 in the firewall. gardience cac status shows the port, the number of authorities, and the revocation checks; gardience cac off closes the port.
2. In the console
Administration > Settings > Smart card sign-in: add each card with Add a card:
- Card ID: the 10-digit DoD ID number (EDIPI) on a CAC, or the email or UPN in a PIV certificate.
- User name: the person's Gardience name. It cannot be the same as a local account.
- Role, and optionally Limited to groups (node groups; not for admins).
Turn on Allow smart card sign-in and Save. The sign-in page then shows Sign in with a smart card (CAC / PIV).
A card that works but is not linked shows its ID to the person, so they can give it to you. Cards refused recently are listed on the settings card with Link to add them.
What is checked
- The certificate chains to an authority in your bundle, is within its dates, and is not revoked (OCSP and/or CRL). A card that fails these never reaches Gardience; the person sees "Card not accepted".
- It is a sign-in certificate (client authentication or smart card logon), not the card's email certificate.
- It is linked to a Gardience user. The person gets a session with that user's role and scope, the same way single sign-on users do, and the audit log records the card and the certificate's serial number.
The card's identity reaches Gardience only from the smart card port: the web server adds a key that only it and the Gardience service hold, so a request made any other way is refused. The sign-in must finish in the same browser that started it.
Removing a card ends that person's open sessions and their role at once. Every change to the list, every smart card sign-in, and every refused card is in the audit log.
After a restore
The smart card files (config/cac) are in backups, but the port setting is not. After restoring onto a new server, run sudo ./gardience cac on again.