pam_usb
pam_usb is a PAM module that enables either two-factor or password-less authentication using a USB storage device (such as a USB flash memory stick). It works with any application supporting PAM, such as su or any login manager (GDM, KDM), etc. The pam_usb package also contains pamusb-agent, a daemon that can trigger actions (such as locking the screen) upon device authentication and removal.
| Tags | Security Systems Administration |
|---|---|
| Licenses | GPL |
| Operating Systems | POSIX Linux |
| Implementation | C |
Recent releases
- 15 Sep 2007 12:45
Changes: Hardware support was improved. Now devices without vendor and model information can be used for authentication. Non-USB devices are now supported, so you can now use every kind of removable storage device, such as SD or MMC cards. Many other smaller bugfixes and features have been included, such as the DBUS workaround and support for Python 2.5.
- 29 May 2007 15:05
Changes: A security issue related to OpenSSH authentication has been fixed. The quiet option has been fixed (now it is really quiet). Support has been added for devices without vendor/model information.
- 09 Apr 2007 13:35
Changes: Both pam_usb and its tools (adm and hotplug) have been redesigned from the ground up and rewritten from scratch. Hardware recognition is now done through HAL, which provides a stable interface over kernel changes. Certificates have been replaced by one time pads. That will prevent copies of the USB device from being used for authentication. pam_usb now verifies device information (vendor, product, serial number, and UUID) in the authentication process. pamusb-agent (formely usbhotplug) make use of DBUS signals (sent by HAL) instead of kernel hotplugging.
- 23 Oct 2005 08:35
Changes: This release adds a verbose mode that prints authentication status while the debug output is turned off. The code that checks whether the authentication is requested locally or remotely has been rewritten, and now works on systems that don't set PAM_TTY properly. There are better default options: on a common setup, you shouldn't need to set any option as the default suits most needs.
- 12 Jan 2005 06:29
Changes: pam_usb will now also try to autodetect /dev/sdN devices (not just /dev/sdNX). A bug that happened when the application using PAM didn't set PAM_TTY correctly was fixed. The use_first_pass and try_first_pass options were added. If you enter your password on another PAM module (such as pam_mount or pam_ssh), pam_usb will now use that password to decrypt the private key.
