Hi folks, I need some help figuring out how to adjust mount options for removable media, specifically USB thumb drives. What I'm trying to do is set up 2FA logins on Ubuntu using pam_usb and a thumb drive as an authentication token. I've got pam_usb installed and configured, but it's a little buggy. Basically, my understanding of how the process is suppose to work is this:

1. plug in USB thumb drive

2. type username at login prompt (or GUI login screen)

3. pam_usb reads it's config, looks for the USB thumb drive, finds the OTP authentication token, reads from the token

4. If the authentication is good, pam_usb completes the login process and writes a new OTP value to the thumb drive

Now, here's the problem, after a successful authentication, I pull the thumb drive from the USB port and hang it back around my neck. Next time I try to use the USB thumb drive to login, the authentication fails.

I've discovered that this is because without properly unmounting the drive (yeah, I know that's the whole idea behind unmounting the device) the new OTP value never actually gets written out to the thumb drive, so the next time I use it, it's reading the old, expired OTP token. What I want to do is fix it so that when I insert the thumb drive, it auto mounts with the sync option so that the new OTP token is written out to the drive immediately, so that I can simply pull the thumb drive and have no problem next time I use it.

I've been reading man pages and posts and I'm not really seeing anything directly on point here, I'm reading myself in circles, going from fstab to udev rules to udisks2 to polkit, etc... Can anyone point me in the right direction here, it sure would be appreciated. Thanks!

Does this software work as intended if you correctly unmount the usb before removing it? Seems like the simplest solution. You should be able to place an entry in fstab for this to work. What have you tried in fstab? Or perhaps a script to run on boot. I'm not familiar with the software so can't really help with that. Good luck.

Hi,

Personally, I would do a 'sync' then a 'umount' of the device to insure that the everything is flushed to the persistent storage (your USB device). I know 'umount' should process a clean dis-mount but I'm old school an wish to have things flushed properly and don't like a lazy 'umount'. I do suggest you look at the 'man' for each command. By just pulling the USB your a likely to cause issues period.

Hope this helps.

Thanks onebuck and yancek for your responses. I haven't modified my fstab yet, my understanding (and please correct me if I'm wrong on this) is that fstab really wasn't intended for removable data storage devices, only for devices that are and will for the most part remain connected to the system such as internal drives. As for manually ejecting (unmounting) the device, it does work most of the time, though not always, sometimes for reasons I haven't figured out yet, when I successfully login using the USB key, unmount it and use it again later, it won't work again, but I think that's another unrelated issue. The reason I am looking for a cache syncing solution here is mainly for ease of use. The USB thumb drive I'm using is on a lanyard (so I don't lose it, as I'm famous for doing) and for occasions when I'm using my system(s) (if this works I have other command line mode Linux boxes I want to use this on), it's simply quicker and easier to just pull the USB key, and hang it back around my neck rather then going through the process of figuring out where the USB key showed up in the /dev tree and then umounting it, which may result in me getting sidetracked and forgetting the USB key. From what I've read, others have had trouble too with pam_usb not syncing the new OTP token to the USB device. I don't know if the cause of what others are experiencing is the same, I suspect file permission issues in some of those cases, I did have that issue as well, but that was easily resolved. I considered writing a small program that would run a CRC on the OTP token file and then monitor the OTP token file's access time and when that changes, run another CRC to see if the contents of the file has indeed changed and if so, force a cache flush, but I'm not sure if the CRC would be coming from the actual file on the USB device or on the cached, updated version waiting to be written to the device.

I know this all may seem as though I making a mountain out of a mole hill here, but I believe there's a way to do this, I remember years ago seeing something relating to changing the caching mode of removable devices, I just don't remember where it was or how to go about doing it.