![]() |
The Pam_usb Project |
% tar -zxvf pam_usb-0.2-beta1.tar.gz % cd pam_usb-0.2-beta1 % make # make installThis will unpack, compile and install the pam_usb module and its administration tool usbadm.
Unique: You can login using your USB pen, if it's
not present, it isn't possible to login.
This mode can be enabled by commenting the line auth required
pam_unix.so (by adding a # at the beginning of the line), and add
the following line:
auth required pam_usb.so
Alternative: Plugging in the USB device is enough to
login.
If it's not present, the system prompts for password.
To use such, add the following line before the auth required
pam_unix.so line:
auth sufficient pam_usb.so
Additional: To login, you have to put the USB device and type
your password.
If you want to use this mode, add the following line before the auth
required pam_unix.so line:
auth required pam_usb.soPlease note that the /etc/pam.d/ directory name, and the pam_unix.so module name are mostly the same in every distro, but could be different (mandrake uses pam_stack.so instead of pam_unix.so).
# mkdir /mnt/usbReplace /mnt/usb with any other inexistent directory (or leave it alone). - Mount the usb pen:
# mount /dev/sda1 /mnt/usbReplace /dev/sda1 and /mnt/usb with the correct device name and mountpoint. If you don't have any clue of what your device entry is, just plug the pen and type dmesg. Usually, if you don't have any SCSI device it should be /dev/sda1. Use an empty directory for mountpoint (the one you just created, for example). Ok, now the device is mounted and we can access it's content via /mnt/usb - Now we can create a couple of private/public keys by using the usbadm tool: The syntax is the following: usbadm keygen <mntpoint> <user> <bits> For example this will generate a private and public key for the user root using a pair of 2048 bits DSA keys.
# usbadm keygen /mnt/usb root 2048 [!] Directory /root/.auth/ not found, creating one... [!] Directory /mnt/usb/.auth/ not found, creating one... [!] Generating 2048 DSA key pair for root@host [!] Extracting private key... [+] Private key extracted. [+] Private key successfully written. [!] Writing public key... [+] Public key successfully written.That's it. This will check the directories needed by pam_usb, generate, extract and write private/public keys for the chosen user for the local host. You can try with any configured application, like login or GDM. For a first test, you may want to use su as you can test it without switching to a console. If it's not working, look at the FAQ section.
# usbadm cipher /mnt/usb root [!] Importing the private key... [+] Private key imported [!] Encrypting the private key may prevent someone to authenticate with your key. The drawback is that pam_usb will prompt you for password every time you authenticate. [?] Which algorithm want you to use ? (none/blowfish/des3): blowfish Enter PEM pass phrase: Verifying - Enter PEM pass phrase: [+] Private key successfully written using cipher blowfishNow every time you authenticate pam_usb will prompt you for password:
# su Your private key is locked using symmetric encryption Passphrase to unlock the key:To switch back to unencrypted private key, use the cipher "none" :
# usbadm cipher /mnt/usb root none [!] Importing the private key... Enter PEM pass phrase: [+] Private key imported [+] Private key successfully written using cipher noneNote that the asked password is the one you setup earlier with blowfish.
# usbadm addserial [+] procfile: /proc/scsi/usb-storage-0/0 [+] serial number: 69S258Q3BP2E2201 [+] attached: yes Allowing serial number 69S258Q3BP2E2201...done.You have to repeat this operation for every USB devices you want to grant. For more informations on usbadm type usbadm help.
name | description | default value |
mntpoint | Tells pam_usb the form of the temporary directory. XXXXXX (6 times) will be replaced by a temporary value. | /tmp/pam_usbXXXXXX |
proc_basename | the device's procfile. You usually don't have to change this, it's where pam_usb searches for devices. | /proc/scsi/usb-storage-%d/%d |
pwfile | The path pam_usb will search for public and private keys (~user/ and mntpoint/) | /.auth/ |
pubkey | The name of the public key located in the user's home | id_pub |
snfile | the serial number file contains the allowed SN. If it doesn't exists, the default behaviour is to grant everything. | /etc/security/usb_serials |
fs | comma-separated list of filesystems used to mount the device | ext2,vfat |
utmp | location of the utmp file | /var/run/utmp |
mount_opts | comma-separated list of mount options (including: ro,bind,sync,remount,nosuid,noexec,nodev) | |
log_file | print debug messages to that file instead of stdout | |
local_consoles | comma-separated list of consoles which be able to login when allow_remote=-1 | /dev/vc/,/dev/tty,: |
local_hosts | comma-separated list of hosts that will be able to login when allow_remote=-1 | : |
force_device | Using this option, you can force pam_usb to use a specified device. If it fails mounting, it'll switch back to auto guess mode | |
allow_remote | When set to -1, will allow only local_hosts and local_consoles to login. | -1 |
check_device | If unset, pam_usb will not check neither if the device is attached, nor its serial number. | 1 |
check_if_mounted | if the usb device is already mounted pam_usb will use its mountpoint (avoid using it) | -1 |
keep_mounted | When set to 1, it'll keep mntpoint mounted. | -1 |
sign_times | Number of times pam_usb will do the sign/check challenge. | 3 |
debug | enable debug mode | -1 |
auth requisite pam_usb.so fs=ext3 debug=1 snfile=/etc/serials