| 1 |
On Wednesday 27 January 2010 11:01:52 Willie Wong wrote: |
| 2 |
> On Tue, Jan 26, 2010 at 04:34:56PM -0800, walt wrote: |
| 3 |
> > After thinking awhile I realized that pam can be used to |
| 4 |
> > combine muliple forms of authentication to reduce the well |
| 5 |
> > documented risk of single-factor authentication (like our |
| 6 |
> > traditional password system). |
| 7 |
> > |
| 8 |
> > Example: if I have an ordinary password, plus an ssh key |
| 9 |
> > stored on a USB stick, plus a biometric device like an |
| 10 |
> > eye scanner or a fingerprint scanner, I can then use any |
| 11 |
> > or all of those methods to identify myself to the system |
| 12 |
> > by configuring pam in the appropriate way. |
| 13 |
> |
| 14 |
> Yes. |
| 15 |
> |
| 16 |
> First look at the PAM configuration section of this: |
| 17 |
> |
| 18 |
> http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader#Login_vi |
| 19 |
> a_pam_bioapi |
| 20 |
> |
| 21 |
> Now if instead of having |
| 22 |
> |
| 23 |
> auth sufficient pam_unix.so ... |
| 24 |
> auth sufficient pam_bioapi.so ... |
| 25 |
> |
| 26 |
> which says that either password log-in OR fingerprint scanner is |
| 27 |
> enough, you change the first line to "auth required ...", per the docs |
| 28 |
> |
| 29 |
> http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration-f |
| 30 |
> ile.html |
| 31 |
> |
| 32 |
> you will then have a behaviour where BOTH password and fingerprint is |
| 33 |
> involved. I think PAM is a Pretty Good Idea and its implementation is |
| 34 |
> Very Cool, but I also think it is completely unnecessary on _my_ |
| 35 |
> laptop. |
| 36 |
|
| 37 |
What would be the pam-way to only allow remote ssh logins using pubkeys and |
| 38 |
completely forbid ssh paswd? I used to remove allow pam from sshd_config. Is |
| 39 |
there a better pam-centric way of doing the same thing? |
| 40 |
-- |
| 41 |
Regards, |
| 42 |
Mick |
Archives