{"id":117,"date":"2005-04-15T05:22:38","date_gmt":"2005-04-15T02:22:38","guid":{"rendered":"https:\/\/void.gr\/kargig\/blog\/?p=117"},"modified":"2005-04-15T05:38:36","modified_gmt":"2005-04-15T02:38:36","slug":"using-a-usb-stick-to-login-to-gentoo","status":"publish","type":"post","link":"https:\/\/www.void.gr\/kargig\/blog\/2005\/04\/15\/using-a-usb-stick-to-login-to-gentoo\/","title":{"rendered":"Using a usb stick to login to gentoo Linux"},"content":{"rendered":"

It was kinda late, and I wanted to do something tonight…something interesting. I was looking at my usb key when I had this flash…”Could I use my usb key to login to my pc with a certain account ?”.
\nGoogling … googling… I need a PAM module to do it. eix time now!
\n#eix pam usb
\n* sys-libs\/pam_usb
\n Available versions: 0.3.1 0.3.2
\n Homepage: http:\/\/www.pamusb.org\/
\n Description: A PAM module that enables authentication using an USB-Storage device (such as an USB Pen) through DSA private\/public keys.
\n<\/code><\/p>\n

Bingo!<\/p>\n

I emerged it and edited \/etc\/pam.d\/system-auth and \/etc\/pam.d\/login
\nIn the very first line of the files I added:
\n auth sufficient \/lib\/security\/pam_usb.so !check_device allow_remote=1 force_device=\/dev\/sda1 fs=vfat debug=1 log_file=\/var\/log\/pam_usb.log
\n<\/code><\/p>\n

Then I just did:
\nusbadm keygen \/mnt\/usb1 root 4096<\/code>
\nas the great quickstart<\/a> of pam_usb<\/a> describes and I am set!<\/p>\n

just a test then…:
\n$ su
\n#
\n<\/code>
\nDamn! I liked that!<\/p>\n

and you can check the debug log too:
\n[device.c:371] Forcing device \/dev\/sda1
\n[device.c:346] Creating temporary mount point...
\n[device.c:354] Scheduling [\/tmp\/pam_usbI7wL6Z] for dropping
\n[device.c:358] Using \/tmp\/pam_usbI7wL6Z as mount point
\n[device.c:237] Trying to mount \/dev\/sda1 on \/tmp\/pam_usbI7wL6Z using vfat
\n[device.c:253] Device mounted, trying to open private key
\n[device.c:181] Opening \/tmp\/pam_usbI7wL6Z\/.auth\/root.XXXXXX
\n[device.c:261] Private key opened
\n[auth.c:207] Private key imported
\n[auth.c:218] Public key imported
\n[device.c:455] Dropping [\/tmp\/pam_usbI7wL6Z]
\n[dsa.c:77] Checking DSA key pair...
\n[dsa.c:87] Signing pseudo random data [1 time(s)]...
\n[dsa.c:94] Valid signature
\n[dsa.c:87] Signing pseudo random data [2 time(s)]...
\n[dsa.c:94] Valid signature
\n[dsa.c:87] Signing pseudo random data [3 time(s)]...
\n[dsa.c:94] Valid signature
\n[pam.c:207] Access granted
\n<\/code><\/p>\n

What about if I remove the usb key ?
\n
\n$ su
\nPassword:
\nsu: Authentication failure
\nSorry.
\n$
\n<\/code><\/p>\n

and the debug log:
\n
\n[device.c:371] Forcing device \/dev\/sda1
\n[device.c:346] Creating temporary mount point...
\n[device.c:354] Scheduling [\/tmp\/pam_usbTMRHEZ] for dropping
\n[device.c:358] Using \/tmp\/pam_usbTMRHEZ as mount point
\n[device.c:237] Trying to mount \/dev\/sda1 on \/tmp\/pam_usbTMRHEZ using vfat
\n[device.c:242] mount failed: No such file or directory
\n[device.c:249] Unable to mount \/dev\/sda1, tried with 1 fs
\n[device.c:376] Device forcing failed, back to guess mode
\n[device.c:419] Cannot find any device
\n[device.c:455] Dropping [\/tmp\/pam_usbTMRHEZ]
\n[auth.c:186] Invalid device
\n[pam.c:203] Cannot authenticate user \"root\"
\n<\/code><\/p>\n

I really liked that today…felt like Mission Impossible..yeah \ud83d\ude1b
\nI wonder if I could make that work with xscreensaver too…would be pretty cool, wouldn’t it ?<\/p>\n","protected":false},"excerpt":{"rendered":"

It was kinda late, and I wanted to do something tonight…something interesting. I was looking at my usb key when I had this flash…”Could I use my usb key to login to my pc with a certain account ?”. Googling … googling… I need a PAM module to do it. eix time now! #eix pam […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"footnotes":""},"categories":[1,3],"tags":[],"class_list":["post-117","post","type-post","status-publish","format-standard","hentry","category-general","category-linux"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t