pam_usb/doc/CONFIGURATION

====== Configuration ======

Configuration is done through the pamusb-conf tool, as explained in the
[[quickstart]] section. Most users don't have to manually change pamusb.conf, 
however if you want to change some default settings, this document explains the
syntax of the pamusb.conf configuration file.

===== Introduction =====

* The configuration file is formatted in XML and subdivided in 4 sections:
  - Default options, shared among every device, user and service
  - Devices declaration and settings
  - Users declaration and settings
  - Services declaration and settings

* The syntax is the following:
<configuration>
 <defaults>
 <!-- default options -->
 </defaults>

 <devices>
 <!-- devices definitions -->
 </devices>

 <users>
 <!-- users definitions -->
 </users>

 <services>
 <!-- services definitions -->
 </services>
</configuration>

* Location of the configuration file

By default, pam_usb.so and its tools will look for the configuration file
located in /etc/pamusb.conf, but you can tell it to use a different file by
using the -c option:

# /etc/pam.d/common-auth
auth    sufficient      pam_usb.so -c /some/other/path.conf
auth    required        pam_unix.so nullok_secure

You will also have to use the -c option when calling pam_usb's tools. For
instance, when calling pamusb-agent:
pamusb-agent -c /some/other/path.conf





===== Options =====

^ Name              ^ Type            ^ Default value       ^ Description  ^
| enable        | Boolean         | true                | Enable pam_usb        
|
| debug         | Boolean         | false               | Enable debug messages 
|
| quiet         | Boolean         | false               | Quiet mode (no verbose
output)                      |
| color_log     | Boolean         | true                | Enable colored output 
|
| one_time_pad  | Boolean         | true                | Enable the use of one
time pads                     |
| deny_remote   | Boolean         | true                | Deny access from
remote host (ssh)                  |
| probe_timeout | Time            | 10s                 | Time to wait for the
volume to be detected|
| pad_expiration| Time            | 1h                  | Time between pads
regeneration|
| hostname      | String          | Computer's hostname | Computer name. Must be
unique accross computers using the same device |                                

| system_pad_directory | String   | .pamusb             | Relative path to the
user's home used to store one time pads |
| device_pad_directory | String   | .pamusb             | Relative path to the
device used to store one time pads|

* Example:

<configuration>
<defaults>
  <!-- Disable colored output by default -->
  <option name="color_log">false</option>
  <!-- Enable debug output -->
  <option name="debug">true</option>
 </defaults>
 <users>
   <user id="root">
     <!-- Enable colored output for user "root" -->
     <option name="color_log">true</option>
   </user>
   <user id="scox">
     <!-- Disable debug output for user "scox" -->
     <option name="debug">false</option>
 </users>
 <devices>
   <device id="sandisk">
     <!-- Wait 15 seconds instead of the default 10 seconds for the "sandisk"
device to be detected -->
     <option name="probe_timeout">15</option>
 </devices>
 <services>
   <service id="su">
     <!-- Disable pam_usb for "su" ("su" will ask for a password as usual) -->
     <option name="enable">false<option>
   </service>
 </services>
</configuration>

===== Devices =====

^ Name            ^ Type      ^ Description                                    ^
Example              ^
| id          | Attribute | Arbitrary device name                          |
MyDevice             |
| vendor      | Element   | device's vendor name                           |
SanDisk Corp.        |
| model       | Element   | device's model name                            |
Cruzer Titanium      |
| serial      | Element   | serial number of the device                    |
SNDKXXXXXXXXXXXXXXXX |
| volume_uuid | Element   | UUID of the device's volume used to store pads |
6F6B-42FC            |


* Example:

<device id="MyDevice">
<vendor>SanDisk Corp.</vendor>
<model>Cruzer Titanium</model>
<serial>SNDKXXXXXXXXXXXXXXXX</serial>
<volume_uuid>6F6B-42FC</volume_uuid>
</device>



===== Users =====

^ Name            ^ Type      ^ Description                                 ^
Example     ^
| id          | Attribute | Login of the user                           | root  
|
| device      | Element   | id of the device associated to the user     |
MyDevice    |
| agent       | Element   | Agent commands, for use with pamusb-agent   | See
below   |

* Example:

<user id="scox">
<device>MyDevice</device>

<!-- When the user "scox" removes the usb device, lock the screen and pause
beep-media-player -->
<agent event="lock">gnome-screensaver-command --lock</agent>
<agent event="lock">beep-media-player --pause</agent>

<!-- Resume operations when the usb device is plugged back and authenticated -->
<agent event="unlock">gnome-screensaver-command --deactivate</agent>
<agent event="unlock">beep-media-player --play</agent>
</user>

===== Services =====

^ Name ^ Type      ^ Description         ^ Example ^
| id   | Attribute | Name of the service | su      |

<service id="su">
<!--
   Here you can put service specific options such as "enable", "debug" etc.
   See the options section of this document.
-->
</service>




===== Full example =====

This example demonstrates how to write a pam_usb configuration file and how to
combine and override options.

<configuration>
<!-- Default options -->
<defaults>
  <!-- Enable debug output by default-->
  <option name="debug">true</option> -->
  <!-- Disable one time pads by default -->
  <option name="one_time_pad">false</option> -->
</defaults>

<!-- Device settings -->
<devices>
  <device id="MyDevice">
    <!-- This part was generated by pamusb-conf -->
    <vendor>SanDisk Corp.</vendor>
    <model>Cruzer Titanium</model>
    <serial>SNDKXXXXXXXXXXXXXXXX</serial>
    <volume_uuid>6F6B-42FC</volume_uuid>

    <!--
      Override the debug option previously enabled by "defaults".
      Everytime a user associated to that device tries to authenticate,
debugging will be disabled.
      For other users using different devices, the debugging will still be
enabled.
    -->
    <option name="debug">disable</option>
  </device>
</devices>

<!-- User settings -->
<users>

  <!-- Authenticate user "root" with device "MyDevice". -->
  <user id="root">
    <device>MyDevice</device>

    <!--
      One time pads were disabled in the "defaults" section.
      Now we want to enable them for the user "root" so we override the option:
    -->
   <option name="one_time_pad">true</option>
  </user>

  <!-- Authenticate user "scox" with device "MyDevice". -->
  <user id="scox">
    <device>MyDevice</device>

    <!-- We want pam_usb to work in quiet mode when authenticating "scox", so we
override the "quiet" option -->
    <option name="quiet">true</option>

    <!-- Agent settings, used by pamusb-agent -->
    <agent event="lock">gnome-screensaver-command --lock</agent>
    <agent event="unlock">gnome-screensaver-command --deactivate</agent>
  </user>
</users>

<!-- Services settings (e.g. gdm, su, sudo...) -->
<services>

  <!-- Disable pam_usb for gdm (a password will be asked as usual) -->
  <service id="gdm">
    <option name="enable">false</option>
  </service>

  <!--
    We already disabled one time pads in the defaults section, but then
re-enabled them for the
    user "root" in the users section.

    Now we want to speed up console login for user root, so we simply override
again the one_time_pad option
    for the "login" (console) service.
  -->
  <service id="login">
    <option name="one_time_pad">false</option>
  </service>
</services>
</configuration>
</code>