![]() |
The Pam_usb Project |
% tar -zxvf pam_usb-0.3.0.tar.gz % cd pam_usb-0.3.0 % make # make installThis will unpack, compile and install the pam_usb module and its tools usbadm and usbhotplug.
Unique: You can login using your USB pen, if it's
not present, it isn't possible to login.
This mode can be enabled by commenting the line auth required
pam_unix.so (by adding a # at the beginning of the line), and add
the following line:
auth required pam_usb.so
Alternative: Plugging in the USB device is enough to
login.
If it's not present, the system prompts for password.
To use such, add the following line before the auth required
pam_unix.so line:
auth sufficient pam_usb.so
Additional: To login, you have to put the USB device and type
your password.
If you want to use this mode, add the following line before the auth
required pam_unix.so line:
auth required pam_usb.soPlease note that the /etc/pam.d/ directory name, and the pam_unix.so module name are mostly the same in every distro, but could be different (mandrake uses pam_stack.so instead of pam_unix.so).
# mkdir /mnt/usbReplace /mnt/usb with any other inexistent directory (or leave it alone). - Mount the usb pen:
# mount /dev/sda1 /mnt/usbReplace /dev/sda1 and /mnt/usb with the correct device name and mountpoint. If you don't have any clue of what your device entry is, just plug the pen and type dmesg. Usually, if you don't have any SCSI device it should be /dev/sda1. Use an empty directory for mountpoint (the one you just created, for example). Ok, now the device is mounted and we can access it's content via /mnt/usb - Now we can create a couple of private/public keys by using the usbadm tool: The syntax is the following: usbadm keygen <mntpoint> <user> <bits> For example this will generate a private and public key for the user root using a pair of 2048 bits DSA keys.
# usbadm keygen /mnt/usb root 1024 [!] Directory /root/.auth/ not found, creating one... [!] Directory /mnt/usb/.auth/ not found, creating one... [!] Generating 1024 DSA key pair for root@host [!] Extracting private key... [+] Private key extracted. [+] Private key successfully written. [!] Writing public key... [+] Public key successfully written.That's it. This will check the directories needed by pam_usb, generate, extract and write private/public keys for the chosen user for the local host. You can try with any configured application, like login or GDM. For a first test, you may want to use su as you can test it without switching to a console. If it's not working, look at the FAQ section.