pam_usb

The Pam_usb Project

Installing pam_usb

% tar -zxvf pam_usb-0.3.0.tar.gz
% cd pam_usb-0.3.0
% make
# make install
This will unpack, compile and install the pam_usb module and its tools usbadm and usbhotplug.

Setup

Now pam_usb can be enabled for your login applications.
A list of applications using PAM is avaible at /etc/pam.d/ (you may want to edit /etc/pam.d/login, and /etc/pam.d/xdm).
pam_usb can work in 3 different modes:

Unique: You can login using your USB pen, if it's not present, it isn't possible to login.
This mode can be enabled by commenting the line auth required pam_unix.so (by adding a # at the beginning of the line), and add the following line:

auth       required        pam_usb.so

Alternative: Plugging in the USB device is enough to login. If it's not present, the system prompts for password.
To use such, add the following line before the auth required pam_unix.so line:

auth       sufficient      pam_usb.so

Additional: To login, you have to put the USB device and type your password.
If you want to use this mode, add the following line before the auth required pam_unix.so line:

auth       required        pam_usb.so

Please note that the /etc/pam.d/ directory name, and the pam_unix.so module name are mostly the same in every distro, but could be different (mandrake uses pam_stack.so instead of pam_unix.so).
For a first usage, you should use a alternative mode, and enable the debug mode.
More info are avaible at the PAM documentation website.

Workarounds

2.6 kernel
As the proc format has changed, a workaround is avaible to use it under a 2.6 kernel.
Add the !check_device option in order to make it work.
Non USB-Storage devices
Since the 0.2_rc2 version, it is possible to use a floppy, a cdrom or another mountable device. To use a floppy add the following options:
!check_device !check_if_mounted force_device=/dev/fd0
Replace /dev/fd0 by the device you're using, as /dev/cdrom if you want to store your private key on such support.
CD-ROMs mounting will require to be read-only. To do so, add the option mount_opts=ro.

Key setup

Now that we told PAM to use pam_usb for authentication, we have to create a couple of private and public keys that will be used for authentication. We will use the fresh installed usbadm tool: First you have to mount the USB device on your favourite mountpoint. - If you didn't create a mountpoint for the usb pen then do so :
# mkdir /mnt/usb
Replace /mnt/usb with any other inexistent directory (or leave it alone). - Mount the usb pen:
# mount /dev/sda1 /mnt/usb
Replace /dev/sda1 and /mnt/usb with the correct device name and mountpoint. If you don't have any clue of what your device entry is, just plug the pen and type dmesg. Usually, if you don't have any SCSI device it should be /dev/sda1. Use an empty directory for mountpoint (the one you just created, for example). Ok, now the device is mounted and we can access it's content via /mnt/usb - Now we can create a couple of private/public keys by using the usbadm tool: The syntax is the following: usbadm keygen <mntpoint> <user> <bits> For example this will generate a private and public key for the user root using a pair of 2048 bits DSA keys.
# usbadm keygen /mnt/usb root 1024
[!] Directory /root/.auth/ not found, creating one...
[!] Directory /mnt/usb/.auth/ not found, creating one...
[!] Generating 1024 DSA key pair for root@host
[!] Extracting private key...
[+] Private key extracted.
[+] Private key successfully written.
[!] Writing public key...
[+] Public key successfully written.
That's it. This will check the directories needed by pam_usb, generate, extract and write private/public keys for the chosen user for the local host. You can try with any configured application, like login or GDM. For a first test, you may want to use su as you can test it without switching to a console. If it's not working, look at the FAQ section.