scox.info - Random Thoughts - pam_usb - Comments

Yet another release of pam_usb - gemtsone supplier

gemtsone supplier — Fri, 09 Jul 2010 11:28:38 +0200

First thought: it should be possible to assign a single agent for all users, instead of for example having to put a screensaver agent for every user account separately.

One Time Pads: The new authentication model of pam_usb - gemtsone supplier

gemtsone supplier — Sat, 12 Jun 2010 04:47:42 +0200

Your views are very good!I very much agree with you, thank you for sharing!
the best jewelry manufacturers in china

Yet another release of pam_usb - Movie

Movie — Sun, 10 Jan 2010 10:46:15 +0100

Thanks. good luck

[ping] One Time Pads: The new authentication model of pam_usb - Fluoxetine capsules.

Fluoxetine capsules. — Thu, 16 Apr 2009 05:27:18 +0200

Fluoxetine.

Fluoxetine side effects. Fluoxetine....

[ping] pam_usb: Finally a new release - Levothyroxine.

Levothyroxine. — Sun, 12 Apr 2009 23:44:49 +0200

Levothyroxine weight loss.

Levothyroxine herb. Levothyroxine soy. Types of levothyroxine....

[ping] Yet another release of pam_usb - Online tramdol.

Online tramdol. — Thu, 26 Feb 2009 23:29:56 +0100

Online tramdol.

Online tramdol....

[ping] Yet another release of pam_usb - Amoxicillin and strep b.

Amoxicillin and strep b. — Sat, 21 Feb 2009 22:49:21 +0100

Amoxicillin alternative.

Amoxicillin strep pharyngitis....

[ping] One Time Pads: The new authentication model of pam_usb - Butalbital medical license.

Butalbital medical license. — Fri, 06 Feb 2009 04:38:09 +0100

Butalbital.

What is butalbital. Butalbital....

[ping] One Time Pads: The new authentication model of pam_usb - Amoxicillin.

Amoxicillin. — Wed, 14 Jan 2009 10:41:06 +0100

Amoxicillin.

Can greyhounds take amoxicillin. Amoxicillin side effects....

One Time Pads: The new authentication model of pam_usb - Jeremy

Jeremy — Tue, 26 Aug 2008 04:59:17 +0200

So say I manage to kill my one-time-pad accidentally. How do I force regenerating a new one?

Yet another release of pam_usb - LK14

LK14 — Mon, 18 Aug 2008 21:59:46 +0200

Hi Andrea

Thanks for the work on pam_usb, working good on my Gentoo boxes.

First thought: it should be possible to assign a single agent for all users, instead of for example having to put a screensaver agent for every user account separately.

Yet another release of pam_usb - benazhack

benazhack — Sat, 15 Sep 2007 01:52:00 +0000

i'm running new version of ubuntu 7.10 gibson...i apt-getted version of pamusb but it returned error no devices found...so i've donwloaded this new version..but now it found my usb key but say that doesn't contain any volume....why??..bugs in dbus..or error in managing of usb disk of this version of kernel (scsi managing)..plz try to understand and give to me a solution...:D

Yet another release of pam_usb - tpearson

tpearson — Sat, 15 Sep 2007 01:52:00 +0000

running pamusb on kubuntu gutsy gibson. how do you put pad on multiple usb devices. i have one for work and one for school and really don;t want to keep swapping. when you create key on both it stops working all together.

Yet another release of pam_usb - Earl

Earl — Sat, 15 Sep 2007 01:52:00 +0000

Hi! I tried the pamusb I'v installed it like its been written on the site but when I try to check if the usb is connected I get something like this, depending on which user I'm checking the devices connection:

sanesh@sanesh-laptop:~$ pamusb-check labor

Unable to change owner of the pad: Operation not permitted
Unable to update pads.sanesh@sanesh-laptop:~$ pamusb-check root
Authentication request for user "root" (pamusb-check)
Device "Kulcs" is connected (good).
Performing one time pad verification...
Verification match, updating one time pads...
Unable to change owner of the pad: Operation not permitted
Unable to update pads.
Access granted.

If I trie to connect in real as labor in recowery mode then a I get this error:

*Cannot connect to system bus: Failed to connect to socket/var/run/dbus/systembussocket: No such file or directory*Acces deniedPassword:

but the file it needs is in the exact place it is loking for... What is the problem?

pam_usb: Finally a new release - T

Mon, 09 Apr 2007 22:35:00 +0000

Hi, I think there might be a bug in pam_usb, I have flash drive, which has no vendor information provided. After adding such device, and a user root assigned to it, the pam_usb says there is "No device configured for user "root"." I tried providing empty vendor in pamusb.conf but it doesn't help. Any suggestions ?

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 22:35:00 +0000

Hi, pam_usb requires the vendor (as well as the model) to be provided in order to consider the device valid. As the user root is linked to a device which is consider invalid, pam_usb thinks no device is configured for that user. I didn't think there were devices without vendor, I'll commit a fix into the SVN soon.

pam_usb: Finally a new release - Ludo

Ludo — Mon, 09 Apr 2007 21:35:00 +0000

Hi, scox,I've just discover pam_usb and i try to use it. I'm in the same case than "T" and it stop in my experiment. My main device doesn't provide vendor information (in "lusb" command for example) and i cannot use it for auth. I'm very impatient for the fix of this, but consider this message like congratulations for your work.Best regards,Ludo,

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 21:35:00 +0000

Fixed in SVN. Thank you for the bug report.

pam_usb: Finally a new release - Batist

Batist — Mon, 09 Apr 2007 21:35:00 +0000

Hi, scox.First of all, I think pam-usb is a great idea. So great even that I'm writing a GUI to edit the xml file (using pygtk), I'll send you the code as soon as I'm finished. But I have one problem... think there is a bug in gksu. When I enable pam-usb in the pam files and my device is not plugged in, gksu won't launch anything... any ideas how to solve this? Greetz,Batist

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 21:35:00 +0000

Hi Batist,

The problem with gksu is that it parses the output of 'su' which now contains pam_usb messages (and gksu doesn't expect those).

A quick solution would be to disable pamusb for the service 'su' so that gksu could work as usual (but without pamusb):

Or you could use pam_usb SVN version with the 'quiet' option:

By enabling this option, pamusb won't print any messages to stdout so gksu should work fine. Beware that pamusb 0.4.0 prints error messages even in quiet mode, so you'll need the SVN version to make this work.

pam_usb: Finally a new release - Detlef

Detlef — Mon, 09 Apr 2007 21:35:00 +0000

Hi scox,first of all i will thank you for this great prog. And now my suggestions ;-)

There should be an Option to remove User/Devices from the Config. Writing and removing entries from the config-file is anoying if you do that manual.
Maybe you can implement a 'silent' Option that will never show any output (beside of 'quiet'). Thats should solve the 'gksu/su' problem too.

Thx and Greetz, Detlef

BTW: Do you ever think about to implement a USB-Auth for GRUB or LiLo?

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 21:35:00 +0000

Hi, thanks for the support :)

About the option to remove user/devices I totally agree. pamusb-conf was started as a hack (and called, scan_devices.py) and then grew in what pamusb-conf is today. I'm planning to add remove, list, edit etc options, so that users shouldn't even have to know there's a XML file behind that.

About the silent option, in pam_usb 0.4.1 the quiet option is now really quiet, so that should do it.

pam_usb: Finally a new release - Batist

Batist — Mon, 09 Apr 2007 21:35:00 +0000

Hi scox,

Indeed, the program is now really quiet and works perfect with gksu!Although editing the xml file is really simple, I can't wait to see the add/remove/list functions.

Great work!Greetz,Batist.

pam_usb: Finally a new release - deadeyes

deadeyes — Mon, 09 Apr 2007 21:35:00 +0000

Hi scox,

First of all, thank you for this great tool.

Second: I am having trouble using my usb stick.I installed pam_usb with gentoo emerge. But if I do pamusb-conf --add-device MyDevice then I get only my external hdd. But not my usb stick.I read about the bug here, I unmerged pam_usb and installed it from svn.Same problem.

It would be great if you can solve this.

Greetings.

This is what is in dmesg when I connect the device:usb 1-4: new high speed USB device using ehci_hcd and address 9usb 1-4: configuration #1 chosen from 1 choicehub 1-4:1.0: USB hub foundhub 1-4:1.0: 1 port detectedusb 1-4.1: new high speed USB device using ehci_hcd and address 10usb 1-4.1: configuration #1 chosen from 1 choicescsi4 : SCSI emulation for USB Mass Storage devicesusb-storage: device found at 10usb-storage: waiting for device to settle before scanningscsi 4:0:0:0: Direct-Access USB 2.0 Flash Disk PROL PQ: 0 ANSI: 0 CCSSCSI device sda: 256000 512-byte hdwr sectors (131 MB)sda: Write Protect is offsda: Mode Sense: 00 06 00 00sda: assuming drive cache: write throughSCSI device sda: 256000 512-byte hdwr sectors (131 MB)sda: Write Protect is offsda: Mode Sense: 00 06 00 00sda: assuming drive cache: write through sda: sda1sd 4:0:0:0: Attached scsi removable disk sdasd 4:0:0:0: Attached scsi generic sg0 type 0

pam_usb: Finally a new release - deadeyes

deadeyes — Mon, 09 Apr 2007 21:35:00 +0000

I also tried with 3.1 and looked into the log file:[pam.c:138] Searching the utmp entry for tty pts/0...[pam.c:152] Authentication request from pts/0 (:0.0)[device.c:74] Directory /proc/scsi/usb-storage-0/ not found[pam.c:198] Device not valid.

Thing is, that my device is /proc/scsi/usb-storage/4

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 21:35:00 +0000

Could you mail me the output of hal-device ?

pam_usb: Finally a new release - Andrea

Andrea — Mon, 09 Apr 2007 21:35:00 +0000

Hi Scox,First of all thanks for the project! :)I've installed latest released version not svn one on a Ubuntu 7.04 distro and every time I try to execute a pamusb-conf --add-device I receive a "No devices detected." message. I've tried a lot of usb and others sdx objects but same result. It seems to be an HAL problem but I really don't know how to solve it. Thanks in advance.

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 21:35:00 +0000

Hi, thanks for the support :)

There seems to be many users experiencing the same problem, so I'm trying to gather as many hal-device outputs as possible (please send me yours too). Perhaps, it might be related to the kernel configuration as the USB tokens seems to be recognized as SCSI devices rather than USB disk drives. The kernel configuration of your system could be useful as well.

pam_usb: Finally a new release - bourlas

bourlas — Mon, 09 Apr 2007 21:35:00 +0000

using the latest version 4.1 i still have the no devices detected problem, i used flash memory from 2 different vendors and still the same problem(ubuntu 7.04) please help

the mount command give this output

bourlas@torrentakos:~$ mount/dev/sdb1 on /media/CBUSB type vfat (rw,nosuid,nodev,shortname=mixed,uid=1000,utf8,umask=077)

Thanks in advance

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 21:35:00 +0000

Hi,

I've commited a fix into the SVN, please let me know if it solves the problem.

pam_usb: Finally a new release - bourlas

bourlas — Mon, 09 Apr 2007 21:35:00 +0000

Thank you scox for the fast answer, I tried the svn version, and still the same.

I tried also the --verbose option on pamusb-conf and the output is the following

bourlas@torrentakos:~/pam_usb$ pamusb-conf --verbose --add-device=CBUSBInspecting /org/freedesktop/Hal/devices/usbdeviceea02168noserial Invalid: 'usb_device.serial'Inspecting /org/freedesktop/Hal/devices/usbdevice00000000_021 Invalid: Device does not contain any volumeInspecting /org/freedesktop/Hal/devices/usbdevice00000000_020 Invalid: Device does not contain any volumeNo devices detected.

using my other flash memory the only difference is the invalid usb_device.vendor

pam_usb: Finally a new release - Jan

Jan — Mon, 09 Apr 2007 21:35:00 +0000

Hey,

first of all, you did a great job. pamusb works very fine, but there is one proplem: When i'm in kde and in the Konsolo from kde and make a "su" i get the following error message:

pam_usb v0.4.0
Authentication request for user "root" (su)
Cannot connect to system bus: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
Access denied.Password:

everything else runs good. login to kdm, login in the first terminal etc.. all without typing in my pw. except su... :( can you help me?

pam_usb: Finally a new release - Jan

Jan — Mon, 09 Apr 2007 21:35:00 +0000

another question. Is it possible that kdm can auto-login you, if the usb stick is connected?

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 21:35:00 +0000

Hi,

New fixes commited to the SVN.

bourlas: You should try again. However, by seeing the output of the first flash drive (usbdevice.serial) i assume the device has no serial number, which is required to work with pamusb. Perhaps the second flash drive will work just fine.

Jan: I'm aware of that problem, I'll try to find why. Autologin is not yet supported, I'm currently trying to fix as much bugs as possible before adding new features.

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 21:35:00 +0000

Jan: I've managed to find out why pam_usb doesn't work with su, it was a DBUS bug. I've sent them a patch and commited a workaround to the SVN.

pam_usb: Finally a new release - bourlas

bourlas — Mon, 09 Apr 2007 21:35:00 +0000

thanks scox, the svn version as of 29/8/07 it does work at least with one of my usb flash memories, when I go back home i will check also the other one

pam_usb: Finally a new release - error3

error3 — Mon, 09 Apr 2007 21:35:00 +0000

Well your soft roxx :-)Thank you for your work.I do have a problem with 0.4.2 version...When I typed 'su' in the console, I have :

No device configured for user "root".and then the root password is asked.It's ok. But this output made gksu not working :-/

I have in service su disabled in pamusb.conf..Any idea ?

pam_usb: Finally a new release - error3

error3 — Mon, 09 Apr 2007 21:35:00 +0000

please read : in the above message

pam_usb: Finally a new release - scox

scox — Mon, 09 Apr 2007 21:35:00 +0000

Hi, you must disable messages for su.To do so, set the su service to quiet:

Otherwise, you could use 0.4.3 along with gksudo which works well without disabling output messages.

pam_usb: Finally a new release - AppSniper

AppSniper — Mon, 09 Apr 2007 21:35:00 +0000

I keep getting an error message: '* No devices configured for user "user".' This is with version 0.4.2 on Ubuntu 7.10 Gutsy. Everything seems to be going find until I go to use the authentication, and it says there are no devices configured every time.

The following is the latest example of my situation:

user@machine:~$ sudo pamusb-conf --add-user user

No device configured for user "user".[sudo] password for user:Which device would you like to use for authentication ?0) CruzerMicro1) SonyMicroVault

User : userDevice : SonyMicroVault

Save to /etc/pamusb.conf ?[Y/n] yDone.user@machine:~$ pamusb-check user

No device configured for user "user".

One Time Pads: The new authentication model of pam_usb - Norbert Klamann

Norbert Klamann — Sun, 08 Apr 2007 20:46:00 +0000

What happens if the attacker is the first one to autheniticate ? Imangine the following timeline:

My USB device lays on the desk, I am not logged in at the moment
Attacker copies the USB-Stick and autheniticates.
I try to authenticate. Ooops !

One Time Pads: The new authentication model of pam_usb - scox

scox — Sun, 08 Apr 2007 20:46:00 +0000

As the pads won't match anymore, you will know that you have been compromised and you will be prompted for your usual password.

You can avoid this kind of problem by using two-factor authentication. In such case, you will be asked for a password before the USB authentication, which means that the attacker must know your password in order to update the pads.

One Time Pads: The new authentication model of pam_usb - justme

justme — Sun, 08 Apr 2007 20:46:00 +0000

Use 2 sticks. One holding the One Time Pad authentication and the other as a "Mold". Make the One Time Pad authentication time sensitive (really expiring after 2 minutes or 5 hours or 6 weeks) after which you can only use the "mold" together with the other usb stick to login. Both used seperate are useless (after expiration of the One Time Pad). Store them on different locations and you have your solution.

One Time Pads: The new authentication model of pam_usb - justme

justme — Sun, 08 Apr 2007 20:46:00 +0000

If flash drives are unique why not use that and store the One Time Pad on de hdd. Then there would be nothing to copy. The One Time Pad would still have to work as I wrote above. It still needs to expire.

One Time Pads: The new authentication model of pam_usb - scox

scox — Sun, 08 Apr 2007 20:46:00 +0000

I don't think pads should ever expire. Actually, they already do: as soon as you authenticate, the old pad isn't valid anymore.

I didn't understand the second comment about storing pads on the hard drive as they currently do. Pads are stored both on the flash drive and the hard drive and compared upon authentication.

One Time Pads: The new authentication model of pam_usb - justme

justme — Sun, 08 Apr 2007 20:46:00 +0000

I think it's a good project and I just got carried away by my enthousiasme.Forget about my second comment. It wasn't well thought out. Using just the flash drives unique ID to login (the pad on the hdd would be compared with just the unique ID on that flash drive) would make you loose a lot of flexibility.Looking forward to your next release.

One Time Pads: The new authentication model of pam_usb - chief

chief — Sun, 08 Apr 2007 20:46:00 +0000

Isn't writing one-time pad onto USB flash disk upon each authentication going to shorten its lifetime? And by how much, any estimates or experiences? I have been using old pam_usb 3.3 for some time now, had been happy with it, and now I am reluctant to upgrade given this sole issue. Please advise. Thank you.

One Time Pads: The new authentication model of pam_usb - chief

chief — Sun, 08 Apr 2007 20:46:00 +0000

I meant 0.3.3, sorry.

One Time Pads: The new authentication model of pam_usb - scox

scox — Sun, 08 Apr 2007 20:46:00 +0000

I assume it will shorten its lifetime, but i don't know how much. Anyway, I'm planning to introduce a new option to set how often pads should be updated (e.g., limit once everyday).

In the meantime, you could disable pads. I think pam_usb 0.4.x is more secure than 0.3.x even with pads disabled, because it does model/vendor/serial verification.

One Time Pads: The new authentication model of pam_usb - some guy on the street

some guy on the street — Sun, 08 Apr 2007 20:46:00 +0000

Variations on two-factor auth; How about, as with ssh key-based authentication, the /private/ key is locked with a password? or similarly the public copy of a pad may be password-encrypted.

One Time Pads: The new authentication model of pam_usb - scox

scox — Sun, 08 Apr 2007 20:46:00 +0000

That's two factor authentication which can already be achieved by coupling pamusb and pamunix in the PAM configuration.

One Time Pads: The new authentication model of pam_usb - Nicholas

Nicholas — Sun, 08 Apr 2007 20:46:00 +0000

It would be better to have a mix of the two methods: an ssl key together with pads. You see, not every single USB key out there has a serial number. Mine doesn't, and anybody who has a key of the same model could potentially forge the authentication.

Another thing you don't specify anywhere in the documentation, is if the authentication is restricted on localhost, or if it's available even to remote connections. I'd hate somebody logging in to my SSH as root without even bothering entering a password :) Please don't tell me to use SSL keys on ssh, I already do, but I found the example intriguing: just think about how many novice users intall every package on their distro and connect to the 'net without a proper firewall.

One Time Pads: The new authentication model of pam_usb - scox

scox — Sun, 08 Apr 2007 20:46:00 +0000

Even if someone has the same model as yours wouldn't have the same pads thus will be rejected in the authentication process.

My bad, I should've specified this in the documentation: the authentication is restricted to localhost. SSH won't authenticate someone through pam_usb. Even issueing commands such as "su" through SSH will ask for a passwod.

One Time Pads: The new authentication model of pam_usb - Thomas

Thomas — Sun, 08 Apr 2007 20:46:00 +0000

pam_usb assumes the existence of pmount on the system, but pmount is not listed in the requirements. Maybe you could correct that, and since pmount is nonstandard on many distributions, maybe you can find a way to replace it?

One Time Pads: The new authentication model of pam_usb - scox

scox — Sun, 08 Apr 2007 20:46:00 +0000

Fixed the documentation.

I'll try to find a way not to depend on pmount anymore, but the problem is mounting a volume requires root privilegies which will fail with screensavers and other applications running as user (and that's when pmount comes handy).

One Time Pads: The new authentication model of pam_usb - cao.shijun

cao.shijun — Sun, 08 Apr 2007 20:46:00 +0000

Good job!thank you Scox!