pam_usb/doc/QUICKSTART

====== Quickstart ======

Before going ahead, make sure to follow the upgrading instructions if you're
using a version of pam_usb prior to 0.4.0.

===== Installing ====


==== Gentoo Linux ====

# emerge -av pam_usb


==== Ubuntu and Debian ====

# apt-get install libpam-usb pamusb-tools


==== Installing from sources ====
* Step 1: Download the latest release
* Step 2: Unpack the distribution tarball

$ tar -zxvf pam_usb-<version>.tar.gz
$ cd pam_usb-<version>

* Step 3: Make sure that you have installed the required dependencies

pam_usb depends on libxml2, PAM, udisks and pmount. pam_usb's tools
(pamusb-agent, pamusb-conf) depends on python, python-celementtree and
python-gobject.

* Step 3: Compile and install

$ make
# make install

==== Installing from git ====

If you want to use the development version, you can fetch the sources from
GitHub
$ git clone git:github.com/aluzzardi/pam_usb.git

===== Setting up =====



==== Devices and Users ====

* Once you've connected your USB device to the computer, use pamusb-conf to add
it to the configuration file:

# pamusb-conf --add-device MyDevice
Please select the device you wish to add.
* Using "SanDisk Corp. Cruzer Titanium (SNDKXXXXXXXXXXXXXXXX)" (only option)
Which volume would you like to use for storing data ?
* Using "/dev/sda1 (UUID: <6F6B-42FC>)" (only option)
Name            : MyDevice
Vendor          : SanDisk Corp.
Model           : Cruzer Titanium
Serial          : SNDKXXXXXXXXXXXXXXXX
Volume UUID     : 6F6B-42FC (/dev/sda1)
Save to /etc/pamusb.conf ?
[Y/n] y
Done.

Note that MyDevice can be any arbitrary name you'd like. Also, you can add as
many devices as you want.

* Users

Now that we have added the devices, we have to configure the users.

  # pamusb-conf --add-user root      
  Which device would you like to use for authentication ?
  * Using "MyDevice" (only option)
  User            : root
  Device          : MyDevice
  Save to /etc/pamusb.conf ?
  [Y/n] y
  Done.

Repeat this step for every other username you'd like to use pam_usb with (e.g.
pamusb-conf --add-user MyUsername).

* In order to check if everything went fine, we are going to use the
pamusb-check tool which will simulate an authentication event.

# pamusb-check root
* Authentication request for user "root" (pamusb-check)
* Device "MyDevice" is connected (good).
* Performing one time pad verification...
* Verification match, updating one time pads...
* Access granted.



==== PAM Module ====

The PAM module pam_usb.so is used to let applications authenticate you using
your USB device instead of asking your password. The default password-based
authentication will be used as fallback if the device authentication goes wrong.

* Depending on the operating system you're using, you have to tell PAM to use
pam_usb.so as default authentication method.  There should be a file named
either common-auth (Gentoo) under /etc/pam.d/. If you do NOT have neither of
those files, you'll have to edit each pam.d service file you want to use (e.g.
/etc/pam.d/su, /etc/pam.d/gdm and so on).

* Locate the following line on /etc/pam.d/common-auth or /etc/pam.d/system-auth:

auth    required        pam_unix.so nullok_secure

* And change it to look something like that:

auth    sufficient      pam_usb.so
auth    required        pam_unix.so nullok_secure

* You should now be able to authenticate the users configured in pamusb.conf
using your USB device:

scox $ su
* pam_usb v.SVN
* Authentication request for user "root" (su)
* Device "MyDevice" is connected (good).
* Performing one time pad verification...
* Verification match, updating one time pads...
* Access granted.

* Try to authenticate to a different application. pam_usb.so should work with
any application using xscreensaver and many more).




==== Agent ====

The pam_usb agent (pamusb-agent) allows you to automatically execute commands
upon locking and unlocking events. Those events are generated when you insert or
remove your authentication device.
To configure the commands, you have to edit pam_usb's configuration file
(/etc/pamusb.conf) and add agent entries into your user section.

For instance, you could automatically start your screensaver as soon as you
remove the device, and deactivate it when you plug the device back.

* GNOME (gnome-screensaver):
<user id="scox">
  <device>MyDevice</device>
  <agent event="lock">gnome-screensaver-command --lock</agent>
  <agent event="unlock">gnome-screensaver-command --deactivate</agent>
</user>

* KDE (kscreensaver):
<user id="scox">
  <device>MyDevice</device>
  <agent event="lock">dcop kdesktop KScreensaverIface lock</agent>
  <agent event="unlock">dcop kdesktop KScreensaverIface quit</agent>
</user>

You can execute more commands by adding extra <agent> entries.


$ pamusb-agent
pamusb-agent[18329]: pamusb-agent up and running.
pamusb-agent[18329]: Watching device "MyDevice" for user "scox"
pamusb-agent[18329]: Device "MyDevice" has been removed, locking down user
"scox"...
pamusb-agent[18329]: Running "gnome-screensaver-command --lock"
pamusb-agent[18329]: Locked.
pamusb-agent[18329]: Device "MyDevice" has been inserted. Performing
verification...
pamusb-agent[18329]: Executing "/usr/bin/pamusb-check --quiet
--config=/etc/pamusb.conf --service=pamusb-agent scox"
pamusb-agent[18329]: Authentication succeeded. Unlocking user "scox"...
pamusb-agent[18329]: Running "gnome-screensaver-command --deactivate"
pamusb-agent[18329]: Unlocked.

Depending on your desktop environment, you have to add pamusb-agent to the list
of autostarted applications so it will be started automatically.

* GNOME:
  - Open System -> Preferences -> Sessions
  - Select Startup Programs and press Add
  - Enter pamusb-agent and press OK
  - Press Close

* KDE:
  - cd ~/.kde/Autostart
  - ln -s /usr/bin/pamusb-agent pamusb-agent

===== Troubleshooting =====


==== Log Analysis ====

Both pam_usb.so and pamusb-agent use the syslog facility to log authentication
attempts.
This can be useful for GUI-driven applications (for instance GDM) where you
don't get to see console output.
Messages are logged with the AUTH facility, they are usually written to
/var/log/auth.log but may vary
depending on the operating system you're using.

# tail -f /var/log/auth.log
pamusb-agent[25429]: Device "sandisk" has been inserted. Performing
verification...
pamusb-agent[25429]: Executing "/usr/bin/pamusb-check --quiet
--config=/etc/pamusb.conf --service=pamusb-agent scox"
pam_usb[25485]: Authentication request for user "scox" (pamusb-agent)
pam_usb[25485]: Device "sandisk" is connected (good).
pam_usb[25485]: Access granted.
pamusb-agent[25429]: Authentication succeeded. Unlocking user "scox"...
pamusb-agent[25429]: Unlocked.


==== Enabling debug ====

Enabling debug messages may help you find out what's wrong.

To enable them, edit /etc/pamusb.conf and set the following option:
<defaults>
  <option name="debug">true</option>
</defaults>

If you wish, you could enable debug messages only for a specific user, device or
service.
For instance, if you want to enable debug messages only for the sudo service,
you could do the following:

<services>
  <service id="sudo">
    <option name="debug">true</option>
  </service>
</services>

===== It works - What next ? =====

* Have a look at the configuration documentation