AWS workspaces documentation change
Summary
Expanded smart card support to Ubuntu clients, updated authentication procedures, and added OS-specific configuration details
Security assessment
The changes enhance documentation for authentication security features (smart cards) by adding support matrix and detailed configuration steps. The explicit limitation about multiple cards and Ubuntu 20.04 exclusion improves security transparency but doesn't address a specific vulnerability.
Diff
diff --git a/workspaces/latest/userguide/smart_card_support.md b/workspaces/latest/userguide/smart_card_support.md index 67ed43cd5..f6cc1d9fc 100644 --- a//workspaces/latest/userguide/smart_card_support.md +++ b//workspaces/latest/userguide/smart_card_support.md @@ -9 +9 @@ Use a smart card to log in to your WorkSpaceUse a smart card with Chrome or Fire -Smart cards are supported using the DCV for Windows and Amazon Linux 2 WorkSpaces, on Windows and macOS clients. WorkSpaces using the PCoIP protocol do not support smart cards. Ubuntu, Rocky Linux, and Red Hat Enterprise Linux WorkSpaces do not currently support smart cards on any protocol. +Smart cards are supported using the DCV for Windows and Linux WorkSpaces, on Windows, macOS, and Ubuntu 22.04 or later clients. WorkSpaces using the PCoIP protocol do not support smart cards. @@ -19 +19 @@ For example, you can use smart cards for in-session authentication while working - * For in-session authentication and pre-session authentication on Linux or Windows WorkSpaces, only one smart card is currently allowed at a time. + * For in-session authentication and pre-session authentication on Linux or Windows WorkSpaces, only one smart card is currently allowed at a time. Simultaneous use of multiple cards may work, but is not supported. @@ -37 +37 @@ For example, you can use smart cards for in-session authentication while working - * Only the WorkSpaces Windows client application version 3.1.1 or later and the macOS client application version 3.1.5 or later are currently supported for smart card authentication. + * Only the WorkSpaces Windows client application version 3.1.1 or later, the macOS client application version 3.1.5 or later, and Ubuntu 22.04 (or later) client application version 2024.1 or later are currently supported for smart card authentication. The WorkSpaces Ubuntu 20.04 client application is not supported for smart card authentication. @@ -62,0 +63,4 @@ After you've entered your registration code, **Insert your smart card** appears +###### Note + +On some versions of WorkSpaces client application you may have to choose **Sign in** before you see **Insert your smart card**. + @@ -71 +75,7 @@ After you've entered your registration code, **Insert your smart card** appears - 6. On the Windows desktop login page, choose **Sign-in options** , then choose the smart card icon. If you have multiple smart cards, choose the one you want to use. Enter your PIN again, then choose **Submit**. On the Linux login page, enter your PIN and choose **Sign In**. + 6. On the Windows desktop login page, choose **Sign-in options** , then choose the smart card icon. If you have multiple smart cards, choose the one you want to use. Enter your PIN again, then choose **Submit**. + +On the Linux login page, enter your PIN and choose **Sign In**. + +###### Note + +You may have to dismiss a lock screen before you see PIN prompt. @@ -94 +104 @@ You can use a smart card within a Linux WorkSpace, on Chrome or Firefox, to auth - 1. Log in to your Linux WorkSpace using the WorkSpaces for Windows client application. + 1. Log in to your Linux WorkSpace using the WorkSpaces client application. @@ -96 +106 @@ You can use a smart card within a Linux WorkSpace, on Chrome or Firefox, to auth - 2. Open Terminal (**Applications** > **System Tools** > **MATE Terminal**). + 2. Open terminal application (e.g., **GNOME Terminal** on Ubuntu, Rocky Linux, or Red Hat Enterprise Linux WorkSpaces, or **MATE Terminal** on AL2 WorkSpaces). @@ -100 +110,3 @@ You can use a smart card within a Linux WorkSpace, on Chrome or Firefox, to auth - cd; modutil -dbdir sql:.pki/nssdb/ -add "OpenSC" -libfile /lib64/opensc-pkcs11.so + cd; modutil -dbdir sql:.pki/nssdb/ -add "OpenSC" -libfile PATH/opensc-pkcs11.so + +where `PATH` is `/usr/lib64` on RPM-based system like Rocky Linux, Red Hat Enterprise Linux, and AL2, and `/usr/lib/x86_64-linux-gnu` on Debian-based systems (Ubuntu WorkSpaces) @@ -125 +137,3 @@ Your WorkSpaces administrator might have already enabled Firefox to work with sm -**Module filename** : `/lib64/opensc-pkcs11.so` +**Module filename** : ``PATH`/opensc-pkcs11.so` + +where `PATH` is `/usr/lib64` on RPM-based system like Rocky Linux, Red Hat Enterprise Linux, and AL2, and `/usr/lib/x86_64-linux-gnu` on Debian-based systems (Ubuntu WorkSpaces)