1 |
On Tue, Jan 26, 2010 at 04:34:56PM -0800, walt wrote: |
2 |
> After thinking awhile I realized that pam can be used to |
3 |
> combine muliple forms of authentication to reduce the well |
4 |
> documented risk of single-factor authentication (like our |
5 |
> traditional password system). |
6 |
> |
7 |
> Example: if I have an ordinary password, plus an ssh key |
8 |
> stored on a USB stick, plus a biometric device like an |
9 |
> eye scanner or a fingerprint scanner, I can then use any |
10 |
> or all of those methods to identify myself to the system |
11 |
> by configuring pam in the appropriate way. |
12 |
|
13 |
Yes. |
14 |
|
15 |
First look at the PAM configuration section of this: |
16 |
|
17 |
http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader#Login_via_pam_bioapi |
18 |
|
19 |
Now if instead of having |
20 |
|
21 |
auth sufficient pam_unix.so ... |
22 |
auth sufficient pam_bioapi.so ... |
23 |
|
24 |
which says that either password log-in OR fingerprint scanner is |
25 |
enough, you change the first line to "auth required ...", per the docs |
26 |
|
27 |
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration-file.html |
28 |
|
29 |
you will then have a behaviour where BOTH password and fingerprint is |
30 |
involved. I think PAM is a Pretty Good Idea and its implementation is |
31 |
Very Cool, but I also think it is completely unnecessary on _my_ |
32 |
laptop. |
33 |
|
34 |
Cheers, |
35 |
|
36 |
W |
37 |
-- |
38 |
Willie W. Wong wwong@××××××××××××××.edu |
39 |
Data aequatione quotcunque fluentes quantitae involvente fluxiones invenire |
40 |
et vice versa ~~~ I. Newton |