pam_usb

The Pam_usb Project

Tips

Key encryption
In some cases you may want to encrypt the private key. By doing this, every time you authenticate your authentication program will prompt for password to unlock the key. This is useful when for example you go to a unsafe place and someone might copy your key. Without decrypting the private key it's not possible to log on.
# usbadm cipher /mnt/usb root   
[!] Importing the private key...
[+] Private key imported
[!] Encrypting the private key may prevent someone to authenticate with
    your key. The drawback is that pam_usb will prompt you for password
    every time you authenticate.
[?] Which algorithm want you to use ? (none/blowfish/des3): blowfish
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
[+] Private key successfully written using cipher blowfish
Now every time you authenticate pam_usb will prompt you for password:
# su
Your private key is locked using symmetric encryption
Passphrase to unlock the key: 
To switch back to unencrypted private key, use the cipher "none" :
# usbadm cipher /mnt/usb root none
[!] Importing the private key...
Enter PEM pass phrase:
[+] Private key imported
[+] Private key successfully written using cipher none
Note that the asked password is the one you setup earlier with blowfish.
Serial numbers ACL
Before going ahead, please note that by now, serial numbers ACL are NOT supported under 2.6 kernels.
You may want to deny all USB devices but yours. This might prevent people copying your key's content to log on:
# usbadm addserial
[+] procfile: /proc/scsi/usb-storage-0/0
[+] serial number: 69S258Q3BP2E2201
[+] attached: yes
Allowing serial number 69S258Q3BP2E2201...done.
You have to repeat this operation for every USB devices you want to grant. For more informations on usbadm type usbadm help.
Mounting read-only
To mount your device as readonly, you may use the mount_opts option as following:
mount_opts=ro
mount_opts may be used for other options such as ro,bind,sync,remount,nosuid,noexec,nodev.
Mount the device to a customized mount point
To do that, you have to insert mntpoint=/mnt/usb, or whatever you want. You may also want to keep it mounted by using keep_mounted, and check_if_mounted to avoid mounting over and over.
File logging
To log debug messages to a file, first enable debug=1 then enter a filename with log_file=/var/log/pam_usb.
Allowing a remote host to use pam_usb
If for any reason you want to login with pam_usb from 192.168.0.1 and 192.168.0.2, you can to it by using local_hosts=:,192.168.0.1,192.168.0.2.
Don't forget the ':' which allows login from local.
Restricting the use of pam_usb to one or more local consoles
This can be done by first forbidding every remote host wich local_hosts="" and then using a comma-separated list of allowed virtual consoles: local_consoles=/dev/vc/1, /dev/vc/2.