Hardware authentication for Linux using ordinary USB Flash Drives.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

181 lines
7.7 KiB

17 years ago
  1. * 0.4.0
  2. - Both pam_usb and its tools (adm, hotplug) have been redesigned from the
  3. ground up and rewritten from scratch.
  4. - Hardware recognition is now done through HAL which provides a stable
  5. interface over kernel changes.
  6. - Certificates have been replaced by one time pads. That will prevent
  7. copies of the USB device to be used for authentication.
  8. - Device's manufacturer properties verification. pam_usb now verifies
  9. device informations (vendor, product, serial number, UUID) in the
  10. authentication process.
  11. - Configuration is now handled in a central place, the pamusb.conf
  12. configuration file. This XML file contains configuration entries for
  13. users, devices and services.
  14. - pamusb-agent (formely usbhotplug) make use of DBUS signals (sent by HAL)
  15. instead of kernel hotplugging. Also, its configuration has been merged
  16. into the pamusb.conf configuration file.
  17. - A new tool named pamusb-check has been added. It can perform authentication
  18. the way the PAM module does. It can be useful for testing and scripting
  19. purposes.
  20. * 0.3.3
  21. - The option keypath is now splitted into local_keypath and device_keypath.
  22. - Fixed a bug that occurred when the TTY entry was empty.
  23. - pam_usb doesn't get anymore the tty name from PAM_TTY as it used to be
  24. empty on some systems.
  25. - Better defaults. The default options have been set to fit most needs,
  26. you are no longer required to use !check_device on 2.6.
  27. - Verbose mode. By default, pam_usb now prints some informations during
  28. the login process (access granted, the reason why access was refused, etc).
  29. This can be turned off using the brand new 'quiet' option.
  30. - Other small fixes.
  31. * 0.3.2
  32. - Now pam_usb will also try to autodetect /dev/sdN devices (not just
  33. /dev/sdNX).
  34. - Fixed a bug that happened when the application using PAM didn't set
  35. PAM_TTY correctly.
  36. - Added the use_first_pass and try_first_pass options.
  37. Now if you enter your password on another PAM module (such as pam_mount
  38. or pam_ssh), pam_usb will use that password to decrypt the private key.
  39. * 0.3.1
  40. - Lot of misc fixes (memory management, Makefiles, sanity checks, etc).
  41. I'd like to thank the PaX Team <pageexec@freemail.hu> who did almost
  42. the whole job.
  43. - Added the hostname option which allows to select what hostname should
  44. be used for authentication (useful for shared public keys over lan).
  45. Thanks to Nicolas Chauvat <chauvat@nerim.net> who reported the issue,
  46. the idea and the patch for this feature.
  47. * 0.3.0
  48. - Not much changes in this version beside a gcc fix, but the 0.2 branch
  49. reached too many new features so i wanted to name this release 0.3.0
  50. as i should have done with 0.2.3
  51. - Fixed a gcc 3.3 compile issue, and all related warning.
  52. I would like to thank the following guys for having reported this bug so fast:
  53. Lalande Fabrice <fabrice.lalande@orange.fr>
  54. Marco <gaedol@softhome.net>
  55. Neil Dunbar <neil.dunbar@hp.com>
  56. * 0.2.3
  57. - Added the usbhotplug tool.
  58. usbhotplug is a hotplug agent that will automagically start a lock handler
  59. when the usb device is removed and an unlock handler when the usb device
  60. is plugged back in and authenticated through pam_usb.
  61. The default handlers will start xlock when the usb device is removed,
  62. and will kill it when the usb device is plugged back in and authenticated.
  63. I'd like to thank Wout Mertens <wmertens@cisco.com> as we had a couple
  64. of discussions about hotplug which helped me implementing this tool.
  65. - The parser can now understand "option" and "!option" instead of
  66. option=1 and option=-1 (e.g. debug !check_device).
  67. Thanks to Jean-Christophe JASKULA <jean.christophe.jasku-la@wanadoo.fr> who
  68. suggested me that and provided an initial patch.
  69. - Fixed a loop bug on serial number checking. Thanks to Zs <horzsol@freemail.hu>
  70. for reporting the bug and a patch to fix it.
  71. - Added the direct_open option which allows to open the private key
  72. using O_DIRECT to avoid disk caching (works only on devices that
  73. supports it). Thanks to myles <myles@tenhand.com> who suggested me that.
  74. - Added some sanity checks here and there because it seems that the PAM
  75. API can return weird stuff from time to time.
  76. - Handling the mount point creation/remotion in a better way which seems
  77. to fix a couple of mntpoint problems.
  78. * 0.2.2
  79. - Added the keep_mounted option, which allows to not umount the mount point
  80. once logged (useful if the gpg/ssh key is stored on there)
  81. - Fixed the mntpoint option: do not delete the directory if it's not a
  82. temporary one.
  83. - Added the support to pass multiple filesystems name with the fs=
  84. option (comma separated list). Changed the default fs to "ext2,vfat"
  85. - Added the log_file option. Takes a filename as a argument.
  86. Combined with debug=1 it can log debug messages to a file.
  87. - Not mounting the device as read-only anymore. Instead, the mount_opts
  88. option has been created. It accepts a comma separated list of mount
  89. options (accepted options are: ro,bind,sync,remount,nosuid,noexec,nodev).
  90. - Fixed an issue which made the allow_remote feature not working correctly
  91. with gdm/kdm.
  92. - Introduced the local_hosts and local_consoles options. They contain a
  93. comma separated lists of hosts and consoles allowed to log in while using
  94. allow_remote=-1
  95. * 0.2.1
  96. - Changed the naming method from x.y to x.y.z
  97. - pam_usb is now able to distinguish local users from remote (as in
  98. logged via ssh), and denies the authentication of non-local users.
  99. Setting allow_remote to 1 disable this feature.
  100. - Mounting is now done in read-only.
  101. - Added the missing mandatory PAM functions.
  102. * 0.2_rc2
  103. - Workaround to make pam_usb not use /proc so it can run on Linux 2.6
  104. By setting check_device to -1, pam_usb will neither check the device's
  105. serial number, nor if it's attached. It's not a real problem if you
  106. don't need serial number checking, but don't combine it with
  107. check_if_mounted.
  108. - Added the force_device capability. Now you can specify a device that
  109. will be mounted without going in guessing mode. If the device cannot
  110. be mounted, it'll switch back to the default guess mode.
  111. Useful if guess mode fails, if you don't want it to try several
  112. devices before getting the right one (so you can login faster), or if
  113. you want to login using a floppy disk, a cdrom or whatever you want.
  114. - Modified the serial number authentication method so now if no serial
  115. numbers are avaible on a device, it will try to use the GUID.
  116. Thanks to Damien Braillard <damien.b@freesurf.ch> who reported the
  117. issue, suggested a way to fix it, and provided a first patch for it.
  118. * 0.2_rc1
  119. - Radically changed the way pam_usb authenticates the user on the
  120. system. Now it works with a pair of DSA keys.
  121. Thanks to Wout Mertens <wmertens@cisco.com> who told me that i could
  122. use a couple of SSH keys to fix the authentication issue.
  123. That gave me the idea to use a set of private/public keys.
  124. Thanks to Ilkka Mattila <ilkka@lyseo.edu.ouka.fi> who helped me to
  125. find out a better way to implement the key challenge: extracting the
  126. public key was inadequate.
  127. Also thanks to those who brought up weird scenarios and/or tested
  128. pre-releases of pam_usb, in alphabetical order:
  129. Ilkka Mattila <ilkka@lyseo.edu.ouka.fi>
  130. Joonas Kortesalmi
  131. Thomas Stewart <thomas@stewarts.org.uk>
  132. Tuure Laurinolli <tuure@laurinolli.net>
  133. * 0.1:
  134. - Now pam_usb doesn't require a mount point. Instead, it creates
  135. a temporary directory under /tmp.
  136. Thanks to Loic Jaquemet <jaquemet@fiifo.u-psud.fr> who gave me the idea.
  137. - Compiles with gcc 2.95 thanks to Tobias Bayer <tobi.bayer@gmx.de> bug
  138. report.
  139. * 0.1-beta2:
  140. - procfile and device entries autodetection have been fixed thanks to
  141. Thomas Stewart <thomas@stewarts.org.uk> bug reports.
  142. - devfs support added. Thanks to Loic Jaquemet <jaquemet@fiifo.u-psud.fr>
  143. for the bug report.
  144. * 0.1-beta1:
  145. - Initial release