Uninstall SafeSign on OSX

While the installation of the SafeSign software is relatively easy, the removal of the software is a bit harder. The installation package lacks an automated removal feature. So removing the driver/application must be done by hand.

The removal of the software (both the SafeSign as well as the TokenLounge software) can be reconstructed by analyzing the original packages/installation scripts.

WARNING: Before you continue, you need to realize that this uninstall procedure is without ANY warranties. So make a backup BEFORE proceding.

The following files are added by the SafeSign software and can be removed:

NOTE: you may need to use the sudo command to actually remove the files.

/Applications/tokenadmin.app

/private/etc/safesign/libaetjcss.dylib.version
/private/etc/safesign/libaetpkss.dylib.version
/private/etc/safesign/registry
/private/etc/safesign/tokenadmin.version

/usr/local/lib/libaetjcss.3.0.1737.dylib
/usr/local/lib/libaetjcss.3.0.dylib -> libaetjcss.3.0.1737.dylib
/usr/local/lib/libaetjcss.3.dylib -> libaetjcss.3.0.1737.dylib
/usr/local/lib/libaetjcss.dylib -> libaetjcss.3.0.1737.dylib
/usr/local/lib/libaetpkss.3.0.1737.dylib
/usr/local/lib/libaetpkss.3.0.dylib -> libaetpkss.3.0.1737.dylib
/usr/local/lib/libaetpkss.3.dylib -> libaetpkss.3.0.1737.dylib
/usr/local/lib/libaetpkss.dylib -> libaetpkss.3.0.1737.dylib
## Items with '->' are symbolic links.

/usr/local/lib/safesign/aetjass1-aegate.jcf
/usr/local/lib/safesign/aetjass1-gdsfse.jcf
/usr/local/lib/safesign/aetjass1-gdssim.jcf
/usr/local/lib/safesign/aetjass1-gem211.jcf
/usr/local/lib/safesign/aetjass1-gempr3.jcf
/usr/local/lib/safesign/aetjass1-gempr3b.jcf
/usr/local/lib/safesign/aetjass1-ibmj20.jcf
/usr/local/lib/safesign/aetjass1-ibmj30.jcf
/usr/local/lib/safesign/aetjass1-mrtsft.jcf
/usr/local/lib/safesign/aetjass1-obtcos.jcf
/usr/local/lib/safesign/aetjass1-rnxmob.jcf
/usr/local/lib/safesign/aetjass1-slbd32.jcf
/usr/local/lib/safesign/aetjass2-aspcts-bio.jcf
/usr/local/lib/safesign/aetjass2-axlctr-bio.jcf
/usr/local/lib/safesign/aetjass2-axlctr.jcf
/usr/local/lib/safesign/aetjass2-cosm64-bio.jcf
/usr/local/lib/safesign/aetjass2-cosm64.jcf
/usr/local/lib/safesign/aetjass2-gdsc30-bio.jcf
/usr/local/lib/safesign/aetjass2-gdsc30.jcf
/usr/local/lib/safesign/aetjass2-gdtigr-bio.jcf
/usr/local/lib/safesign/aetjass2-gdtigr-odd.jcf
/usr/local/lib/safesign/aetjass2-gdtigr.jcf
/usr/local/lib/safesign/aetjass2-ibmsmx-bio.jcf
/usr/local/lib/safesign/aetjass2-ibmsmx.jcf
/usr/local/lib/safesign/aetjass2-kbtsmx.jcf
/usr/local/lib/safesign/libaetjcss.dylib.version
/usr/local/lib/safesign/libaetpkss.dylib.version
/usr/local/lib/safesign/tokenadmin.version

/Users/<username>/Library/Preferences/com.aeteurope.tokenmanager.plist

The following files are added by the TokenLounge software and can be removed:

/Applications/TokenLounge.app

/System/Library/Security/tokend/SafeSign.tokend/Contents/Info.plist
/System/Library/Security/tokend/SafeSign.tokend/Contents/PkgInfo
/System/Library/Security/tokend/SafeSign.tokend/Contents/MacOS/SafeSign
/System/Library/Security/tokend/SafeSign.tokend/Contents/Resources/
/System/Library/Security/tokend/SafeSign.tokend/Contents/Resources/safesign_csp_capabilities.mdsinfo
/System/Library/Security/tokend/SafeSign.tokend/Contents/Resources/safesign_csp_capabilities_common.mds
/System/Library/Security/tokend/SafeSign.tokend/Contents/Resources/safesign_csp_primary.mdsinfo
/System/Library/Security/tokend/SafeSign.tokend/Contents/Resources/safesign_dl_primary.mdsinfo
/System/Library/Security/tokend/SafeSign.tokend/Contents/Resources/safesign_smartcard.mdsinfo

/Users/<username>/Library/Preferences/com.aet.TokenLounge.plist

/Library/Application Support/TokenLounge/AETLogo.tif

NOTE: the TokenLounge software also 'replaces' the Apple Logo on the login screen with the AET Europe logo. In the postinstall script the original logo gets renamed to _applelogo.tif

Postinstall script

#!/bin/sh

echo '*** Remove token cache ...'
rm -rf /var/db/TokenCache/tokens/com.aet.tokend.safesign*
echo '*** Install tokend ...'
mkdir -p /var/tokend
chown tokend /var/tokend
chmod 0700 /var/tokend
echo '*** Install loginwindow icon ...'
cd /System/Library/CoreServices/SecurityAgentPlugins/loginwindow.bundle/Contents/Resources/
test -f _applelogo.tif || mv applelogo.tif _applelogo.tif
ln -sf /Library/Application\ Support/TokenLounge/AETLogo.tif applelogo.tif

cd /System/Library/CoreServices/SecurityAgent.app/Contents/Resources/
test -f _applelogo.tif || mv applelogo.tif _applelogo.tif
ln -sf /Library/Application\ Support/TokenLounge/AETLogo.tif applelogo.tif

exit 0

The location of this file is:

/System/Library/CoreServices/SecurityAgent.app/Contents/Resources/applelogo.tif

Just rename this file:

cd /System/Library/CoreServices/SecurityAgent.app/Contents/Resources/applelogo.tif
cp /System/Library/CoreServices/SecurityAgentPlugins/loginwindow.bundle/Contents/Resources/applelogo.tif .

Any additions on the files removal are more than welcome.

Comments

[Chris]

The fact that the SafeSign-Installer illegitimately modifies a noninvolved component in the system is outrageous. Even if it is "just a logo".

[Willem]

@Chris: don't forget that this is common practice on the Windows-side of things. There are numerous (security) applications that alter the Windows GINA as well. SafeGuard from Utimaco is such an application.
The major difference is that they have documented it completely, and you can alter this by a simple registry edit.

[Chris]

That's not the point. The systems of the customers are not their playground. It illustrates a substantial lack of professionalism by the manufacturer.

[Chris]

PS: Nobody should give it a serious consideration if the manufacturer act infantile like that. Especially if they tinker a CoreService just for fun.

[Noch nie erlebt… | bigge]

[...] alle, die das gleiche Problem haben, hat Willem die Lösung parat. Im Terminal folgendes eintippen: cd [...]