Ubuntu 18.04 and military Common Access Card (CAC)

[Arne]

Hi, all I can tell is that our organization is using a Pulse Secure Version 9.0.3 client (1667) on Windows 10 computers, and I don't know if that is vADC, nor do I personally have access to the code or serial number. I need to gather facts so that I can find out why it's not set up for Linux.

At any rate, I believe our organization with over 11,000 people "should" be providing this service to those of us who want to use Linux, but just hasn't set it up. If it's not paid for by our organization, I would like to know what the costs are in any software or hardware licensing fees, and a general idea of how many person-hours it takes to set up and maintain so that I can make the case for them to do get it set up.

I read a message in our organization's forum that Pulse Secure for Linux does not work with a military Common Access Card (CAC), and I would like to get an answer about whether that was or is still the case. Currently, there is a requirement to login with a CAC for onsite Linux wireless access. We also need to login with a CAC using Pulse Secure for wired and unwired access off site.

[Arne]

Hi,

How do I go about settting up Pulse Secure on Ubuntu 18.04 with a military Common Access Card (CAC)?

-Arne

[pwallace]

Hello, was this to set up Pulse Connect Secure, for Pulse vADC, or another product?

Let me know and I will move this query to the correct forum.

[pwallace]

Ok, that is Pulse Connect Secure - I will move this thread to that forum

[zanyterp]

Hi @Arne,

Can you let me know what type of service is being provided to the Windows 10 users: VPN or NAC? From the description, it appears to be NAC (at least on-prem). Yes, that is correct that the Pulse Linux client does not support CAC auth. I believe that the PPS should be able to do native 802.1x authentication for Linux if the native supplicant supports CAC with 802.1x.

if it is for VPN access, the lack of CAC support is still present.

person-hours for maintenance: should be around 2 a year (for upgrades).
person-hours for initial config? no easy way to guess; but i would forecast less than 50; but could be more (just because there are always details that pop up unexpectedly or do not work as expected)

[Arne]

Hi,

If Network Access Control (NAC) is more stringent than VPN, then yes, that would likely be what we have. My cursory reading on NAC seems to indicate it would give admins fine grain control on access. Machines that don't pass scans get put in quarantine until they are fixed.

Pulse Secure not supporting CAC authentication will prevent me from using a Linux system to telework from conferences and at home.

The WiFi system requires CAC for two-factor authentication, so that will be an issue I'll have to work on my own since Ubuntu's generic WiFi login interface won't work.

Thanks for the work-hour quotes of 50 for setup and 2 for annual maintenance.

I really appreciate your rapid feedback. Over time, I hope to find and engage the right folks to enable Linux telework.