Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to be able to authenticate with PAM using a USB drive with a file on it. I've read about how to do this with a PAM module that reads the specific USB hardware ID of a device, but if the device malfunctions or is lost, there would be no way to authenticate. I would prefer to use the method BitLocker uses, requiring a particular file to be found on the drive in order to authenticate. That way I can keep another drive in a secure location as a backup.

Any other suggestions are welcome. I just want to require a higher level of security that just a password.

Edit: The existing pam way (that I don't like): http://ubuntuforums.org/showthread.php?t=17571

share|improve this question
    
How does "Make the keys on the usb memory stick" imply that it uses the hardware ID of the drive? – Ignacio Vazquez-Abrams Dec 22 '10 at 16:04
    
    
@Ignacio: The file doc/FAQ in pam_usb source does: "The USB device is both identified by its manufacturer attributes (vendor, product, serial number) and by a few random bytes called one time pads that pam_usb writes and updates on the USB device upon authentication." – grawity Dec 22 '10 at 20:10
up vote 1 down vote accepted

PAM modules are stackable. It's very easy to configure authentication so that if one module fails, it falls back to asking for a password. So I see no reason for you not to use pam_usb (as suggested in the Ubuntu Forums thread).

auth    sufficient      pam_usb.so
@include common-auth

(Note sufficient as opposed to required)

share|improve this answer
    
That's true, but I'm trying to require the USB. As in, if someone was to install a keylogger and get the password, they still cannot gain access without the physical device. – themicahmachine Dec 22 '10 at 20:13
    
@themicahmachine: 1) If somebody manages to install a keylogger that affects the login screen, he must already have root access, in which case you're own3d, USB or no USB. 2) A device check like that is merely a check, which can be easily bypassed: the same forum page mentions single-user mode, which skips PAM and only checks shadow. For such checks to work, you would need strict physical security - locked case, restricted bootloader. – grawity Dec 22 '10 at 20:18
    
@themicahmachine: One workaround I can think of is to have one device for yourself and another for root. If you lose device A, login as root and configure a new one. If you lose device B, login as yourself, su(do) to root, configure a new device. // Alternatively, you could require either USB or one-time password (a list of which you stash away in the "backup key" location; there also are PAM modules for token-generated passwords). – grawity Dec 22 '10 at 20:20
    
Good points... I'm marking your answer as correct just for all the good info. It seems like I can accomplish what I want using TrueCrypt and running full-disk encryption and putting the boot loader on a usb stick. No USB = no decrypting the drive. And as far as key loggers... If someone has physical access to the machine they could install a hardware key logger. USB device that goes inline between the keyboard and the computer... undetectable unless you actually look behind the machine. – themicahmachine Dec 22 '10 at 22:40
1  
@themicahmachine: In case of hardware keylogger, even your full-disk encryption password will be logged. (But FDE is still a better option than simple USB check, as with the latter the attacker might be able to boot from his own media, bypassing all other kinds of protection.) – grawity Dec 22 '10 at 23:47

Here is a faq that i typed up a while back. maybe it can be of use.

http://forums.debian.net/viewtopic.php?t=110813

share|improve this answer
1  
Hi jesse, while this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. Please take a look here: Why and how are some answers deleted? – bummi Apr 22 '15 at 9:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .