Hi there

I am trying to install pam_usb at home and at the office. Don't really need it at home, but at the office, since I am admin, I require to type in my root password a lot, and usually there's a person standing at my desk and I don't want them to see my password. So I usually go like 'turn around' or hide my hands under a sheet of paper while typing in the password...

I considered smart cards, but why buy something if I already have usb sticks galore?

Ok, so I found pam_usb, installed it via yum, created my keys, and then went to try and use su - but it keeps saying

* pam_usb v0.3.3, (C) 2003-2005 Andrea Luzzardi <scox@sig11.org>
* Authentication denied: remote user.

It does not even try to access the usb device (I would know this by the flashing of the led on the usb stick)

So I tried a few things, like autofs, which works when I go to the directory /mnt/auto/Home_Keys , I added an entry in fstab and played with the options but nothing seems to work.

------= Command history =---------
usbadm keygen /mnt/auto/Home_Keys andy 2048
[!] Directory /mnt/auto/Home_Keys/.auth/ not found, creating one...
[!] Generating 2048 DSA key pair for andy@earth.Andy.home
[!] Extracting private key...
[+] Private key extracted.
[+] Private key successfully written.
[!] Writing public key...
[+] Public key successfully written.
[root@earth /]# usbadm keygen /mnt/auto/Home_Keys root 2048
[!] Generating 2048 DSA key pair for root@earth.Andy.home
[!] Extracting private key...
[+] Private key extracted.
[+] Private key successfully written.
[!] Writing public key...
[+] Public key successfully written.

-------= /etc/auto.master =-----------
/mnt/auto /etc/auto.tero --timeout=4

-------= /etc/auto.tero =-------------
Home_Keys -fstype=ext3,rw,nosuid,nodev,user :/dev/sdd1

-------= /etc/fstab =-----------------
/dev/sdd1 /mnt/Home_Keys ext3 noauto

-------= /etc/pam.d/su =--------------
#%PAM-1.0
auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth required pam_wheel.so use_uid
auth sufficient pam_usb.so force_device=/dev/sdd1
auth include system-auth
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
password include system-auth
session include system-auth
session optional pam_xauth.so


System Information:

Linux earth.Andy.home 2.6.20-1.2925_1.fc6.cubbi_suspend2 #1 SMP Thu Mar 15 13:15:19 CET 2007 i686 i686 i386 GNU/Linux

pam-0.99.6.2-3.16.fc6
pam_usb-0.3.3-6.fc6

Thank you for any help.

Andy

Hmm. Maybe post the exact steps you took to make this work (HOWTO URI?). Would make it easier for us to see which parts of the system are involved and how we could make them spit out debug info. What do dmesg and syslog say from the moment you add the stick? Does the stick get mounted? Did you try running your complete PAM stack with "debug" flag added (where appropriate)?

I used the very simple how to found at http://www.pamusb.org/quickstart.html

Stick is configured on automount, so when it is present and I go to a certain directory, I do see the auth files.

dmesg usually says something like new highspeed device, waiting for it to settle before scanning, and then attached sdd or sde

Not sure how to turn on debugging for the entire pam stack though.

OK. The "quickstart" page says you should work on login or related PAM stacks in /etc/pam.d/ like or xdm. "su" is not a login. Debug options like setting the debug and logfile flags are explained on the "options" page.

su IS a login, as found in /etc/pam.d/su

this is the current file for su:

#%PAM-1.0
auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth required pam_wheel.so use_uid
auth sufficient pam_usb.so !check_device !check_if_mounted force_device=/mnt/auto/Home_Keys

auth include system-auth
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
password include system-auth
session include system-auth
session optional pam_xauth.so

su IS a login, as found in /etc/pam.d/su
IMHO the fact you have a PAM su conf doesn't mean it's a login as in "logging in to a box". Of course it might be that I'm just an inexperienced and babbling simp, a total dolt w/o any clue wrt *NIX concepts and such. In any case I'd say try to get "login" or "xdm" to work, as posted in the HOWTO, before anything else.

From the message you get, I'd try changing
to
I can't vouch for this working, as I am currently just looking into installing pam_usb, but another how to I've seen had people getting around that error this way. I'd be interested to see if it works for your su problem.

Love your sarcasm. Thanks. Really!

Hi all

I have tried the allow_remote=1 option and it does work, finally!

As far as login or xdm or even kdm is concerned, I do not care, since I do not want to run my desktop as root anyway.

What would be really nice,that one would be able to insert the usb device AFTER it prompts for password, and then when you stick the stick(!) in, it validates you as root.

Thanks all for your help!

I'm glad that worked for you!

Now, I've gone ahead and set up pam_usb, and overall it works great. The only thing is that it still goes to a password prompt when unlocking the screen. This would be okay since I don't really ever manually lock the screen, but when I switch users it automatically locks the screen for the old user. So, when I switch back, I'm asked for my password.

Does anybody know how to get pam_usb to work for unlocking the screen?

EDIT: forgot to mention the only change in the pam.d files I made was adding the pam_usb line to common-auth.

I noticed something else too

When you do the command su -c 'ssh somehost' then it gains root privileges through pam_usb, but does not do shared key authentication for some reason. I have to type in the root password for somehost.