pam_panic/README.md

67 lines
2.0 KiB
Markdown
Raw Normal View History

2018-03-27 01:32:29 +00:00
# pam\_panic
## Purpose
The pam\_panic PAM module shall protect people who have value data on their computer. It provides a panic function.
2018-03-27 02:20:16 +00:00
## How it works
2018-03-27 13:52:32 +00:00
There exist a good and a bad flash drive.
The good flash drive will let you pass to the password prompt.
The bad flash drive will execute a reboot, poweroff and/or erase the luksHeader which will make your luksContainer undecryptable to anyone.
2018-03-27 01:32:29 +00:00
## Installation
You need gcc or something similar.
To compile and install it you may want to do the following within this project directory:
```
make
sudo make install
```
### Compiling notes
The Makefile passes the pathes of `reboot`, `poweroff` and `cryptsetup` using macros to be sure that it will run on different machines.
2018-03-27 13:52:32 +00:00
You need libpam's development package. Some call them `libpam0g-dev`.
2018-03-27 01:32:29 +00:00
## Preparation
You need two GPT formatted removable devices. There must be at least one partition on it. Here is an example with `fdisk`:
```
$ sudo fdisk /dev/sdc
Welcome to fdisk (util-linux 2.31.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.
Command (m for help): g
Created a new GPT disklabel (GUID: AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA).
Command (m for help): n
Partition number (1-128, default 1):
First sector (2048-15661022, default 2048):
Last sector, +sectors or +size{K,M,G,T,P} (2048-15661022, default 15661022):
Created a new partition 1 of type 'Linux filesystem' and of size 7.5 GiB.
Command (m for help): w
```
2018-03-27 13:52:32 +00:00
You'll find the UUID of your partition in `/dev/disk/by-partuuid/`. You can find out which device is which typing `ls -l /dev/disk/by-partuuid/` in your favourite shell.
2018-03-27 01:32:29 +00:00
## Integration
To let it integrate with your system, add the following at the top of of your pam.d config(s):
```
auth requisite pam_panic.so auth=<UUID> reject=<UUID> reboot serious=<UUID>
account requisite pam_panic.so
```
See `man 8 pam_panic` for more.
## TODO
2018-03-27 02:23:40 +00:00
- Asking for man page translations.
- Integrate panic password(?)