HOWTO: pam_usb login with USB memory stick

[mriedel]

I use pam_usb in sufficient mode for common-auth. I'd prefer to have some kind of notification or confirmation prompt or window respectively when pam_usb is used to authenticate. Without it, my setup practically grants root to any process as long as the usb stick is plugged in. Starting up synaptic, for example, leads to immediate pam_usb authentication. Had I not used it before, I wouldn't even know that I just granted root privileges to it.

[mriedel]

bump

[jouva]

I'm not sure if this is the right place to ask for that. But you may want to ask for that on http://brainstorm.ubuntu.com/ however considering there are very few people that use it, it may not get bumped up a lot.

[Brothertucker]

I am kind of a beginner and was wondering if you could give me detailed instructions on how to install PAM_USB.

[jouva]

I am kind of a beginner and was wondering if you could give me detailed instructions on how to install PAM_USB.

Post #18 in this thread should give a decent amount of information.

[SnappyU]

Everything is working fine ... but note the following.
Tested on Ubuntu 8.10

PAM Module *IMPORTANT*
According to the site above:
Locate the following line on /etc/pam.d/common-auth or /etc/pam.d/system-auth:

auth required pam_unix.so nullok_secure

And change it to look something like that:

auth sufficient pam_usb.so
auth required pam_unix.so nullok_secure

For Ubuntu 8.10, the above would cause strange behaviour, instead change it to the following:

auth sufficient pam_usb.so
auth [success=1 default=ignore] pam_unix.so nullok_secure

[HuckBerry]

So I've been fiddling around with pam_usb for quite some time now and I have it working in many cases. I can login with the graphic welcome screen, I can bypass my password when resuming from xscreensaver and I can su,sudo su,gksudo just fine.

My issue is that all of this works only when the device is mounted. But the pam_usb site clearly states the device doesn't have to be mounted in order for authentication to take place. This defeats the primary function of pam_usb which is: sitting down, plugging in a usb device, and logging in with no password.

Should I have also altered fstab or a related file so the device would mount upon insertion, even if no user is logged in? Or does pam_usb just not have the proper authority to mount devices?

~Huckle Berry

[M4NIC]

I have a completely different problem. Ive installed pam_usb through apt-get and it seems to be installed ok. However, when I try to add a device as per the instructions, I get the following errors:

root@ubuntu:~# pamusb-conf --add-device SD1
Traceback (most recent call last):
  File "/usr/bin/pamusb-conf", line 258, in <module>
    '/org/freedesktop/Hal/Manager')
  File "/var/lib/python-support/python2.6/dbus/bus.py", line 244, in get_object
    follow_name_owner_changes=follow_name_owner_changes)
  File "/var/lib/python-support/python2.6/dbus/proxies.py", line 241, in __init__
    self._named_service = conn.activate_name_owner(bus_name)
  File "/var/lib/python-support/python2.6/dbus/bus.py", line 183, in activate_name_owner
    self.start_service_by_name(bus_name)
  File "/var/lib/python-support/python2.6/dbus/bus.py", line 281, in start_service_by_name
    'su', (bus_name, flags)))
  File "/var/lib/python-support/python2.6/dbus/connection.py", line 622, in call_blocking
    message, timeout)
dbus.exceptions.DBusException: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.Hal was not provided by any .service files

Anybody has anything similar? I can verify that the dependencies for pamusb-conf are met. I have tried to cover the dependencies of pamusb itself (libxml2, PAM, HAL and pmount) but arent these relevant only when compiling? Ive also updated dbus but to no change :/

Any help appreciated

[HuckBerry]

root@ubuntu:~# pamusb-conf --add-device SD1

would probably be better written as

root@ubuntu:~# pamusb-conf --add-device=test

note that there is a '=', no ' ', and that the name for the device is irrelevant because it is only used internally within pamusb-conf.

Are you using version 0.4.2-1 of libpam-usb and pamusb-tools? As I cannot recreate your error. If so, you may want to:

sudo apt-get purge pamusb-tools libpam-usb pmount
sudo apt-get clean
sudo apt-get install pamusb-tools libpam-usb pmount

This will remove the pamusb and it's major dependencies and configs then clear your cache of packages and redownload/install the libs. It is possible the copy you have got corrupted when you downloaded it.

post a "#pamusb-conf --verbose --add-device=WHATEVER" before and after you do the above suggestion.

[M4NIC]

Ive tried with the = but I still get the same error:

root@ubuntu:~# pamusb-conf --add-device=SD1
Traceback (most recent call last):
  File "/usr/bin/pamusb-conf", line 258, in <module>
    '/org/freedesktop/Hal/Manager')
  File "/var/lib/python-support/python2.6/dbus/bus.py", line 244, in get_object
    follow_name_owner_changes=follow_name_owner_changes)
  File "/var/lib/python-support/python2.6/dbus/proxies.py", line 241, in __init__
    self._named_service = conn.activate_name_owner(bus_name)
  File "/var/lib/python-support/python2.6/dbus/bus.py", line 183, in activate_name_owner
    self.start_service_by_name(bus_name)
  File "/var/lib/python-support/python2.6/dbus/bus.py", line 281, in start_service_by_name
    'su', (bus_name, flags)))
  File "/var/lib/python-support/python2.6/dbus/connection.py", line 622, in call_blocking
    message, timeout)
dbus.exceptions.DBusException: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.Hal was not provided by any .service files

The version is 0.4.2-1. Ive removed it and reinstalled it as you said but I still get the same error :/

root@ubuntu:~# pamusb-conf --add-device=sd1
Traceback (most recent call last):
  File "/usr/bin/pamusb-conf", line 258, in <module>
    '/org/freedesktop/Hal/Manager')
  File "/var/lib/python-support/python2.6/dbus/bus.py", line 244, in get_object
    follow_name_owner_changes=follow_name_owner_changes)
  File "/var/lib/python-support/python2.6/dbus/proxies.py", line 241, in __init__
    self._named_service = conn.activate_name_owner(bus_name)
  File "/var/lib/python-support/python2.6/dbus/bus.py", line 183, in activate_name_owner
    self.start_service_by_name(bus_name)
  File "/var/lib/python-support/python2.6/dbus/bus.py", line 281, in start_service_by_name
    'su', (bus_name, flags)))
  File "/var/lib/python-support/python2.6/dbus/connection.py", line 622, in call_blocking
    message, timeout)
dbus.exceptions.DBusException: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.Hal was not provided by any .service files

any other ideas are more than welcome