pam_panic/man/man8/pam_panic.8

198 lines
5.0 KiB
Groff
Raw Normal View History

2018-03-28 02:34:52 +00:00
'\" t
.\" Title: pam_panic
.\" Author: [see the "AUTHORS" section]
.\" Date: 2018-03-26
.\" Manual: Linux-PAM Panic Manual
.\" Source: Linux-PAM Panic Manual
.\" Language: English
.\"
.TH "PAM_PANIC" "8" "2018-03-26" "PAM Panic Manual" "PAM Panic Manual"
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
2018-03-31 23:53:41 +00:00
pam_panic \- PAM module with panic function to protect sensitive data in emergency situations
2018-03-28 02:34:52 +00:00
.SH "SYNOPSIS"
.HP \w'\fBpam_panic\&.so\fR\ 'u
2018-03-31 23:53:41 +00:00
\fBpam_panic\&.so\fR [password] [allow=\fIUUID(GPT)\fR] [reject=\fIUUID(GPT)\fR] [reboot] [poweroff] [serious=\fIUUID\fR]
2018-03-28 02:34:52 +00:00
.SH "DESCRIPTION"
.PP
2018-03-28 03:07:39 +00:00
The pam_panic PAM module protects sensitive data and provides a panic function for emergency situations\&.
2018-03-28 02:34:52 +00:00
.PP
2018-03-31 23:53:41 +00:00
There are two possible options in how to use this PAM module:
.PD 0
.PP
First possible option:
.RS 2
There are two removable media which work as keys: the auth key and the panic key\&.
The auth key will let you pass to the password prompt whereas the panic key will execute the panic function\&.
.RE
Second possible option:
.RS 2
There are two passwords: the key password and the panic password\&. The key password will let you pass to the original password prompt whereas the panic password will execute the panic function\&.
.RE
.PD 1
.PP
The panic function:
.RS 2
Its behaviour is defined through the arguments \fBreboot\fR, \fBpoweroff\fR and/or \fBserious\fR\&.
.RE
2018-03-28 02:34:52 +00:00
.SH "OPTIONS"
.PP
2018-03-31 23:53:41 +00:00
\fBpassword\fR
.RS 4
Activates the password function having a panic and key password\&.
If the options \fBallow\fR and \fBreject\fR are provided this option will be ignored\&.
.PD 0
.PP
To set the passwords the program \fBpam_panic_pw\fR(1) is provided\&.
.RE
.PD 1
.PP
\fBallow=\fR\fB\fIUUID(GPT)\fR\fR
2018-03-28 02:34:52 +00:00
.RS 4
2018-03-28 03:07:39 +00:00
The UUID of the device to be used for authentication (the auth key)\&.
2018-03-28 02:34:52 +00:00
.PD 0
.PP
.PD 1
2018-03-28 20:15:20 +00:00
The device must be GPT-formatted and contain at least one partition\&.
The UUID of a GPT-formatted device looks like "12345678-9ABC-DEF0-1234-56789ABCDEF0"\&.
2018-03-28 02:34:52 +00:00
.PP
2018-03-28 03:07:39 +00:00
See \fBHOW TO DETERMINE MY UUIDS\fR for details\&.
2018-03-28 02:34:52 +00:00
.RE
.PP
2018-03-31 23:53:41 +00:00
\fBreject=\fR\fB\fIUUID(GPT)\fR\fR
2018-03-28 02:34:52 +00:00
.RS 4
2018-03-28 18:36:10 +00:00
The UUID of the device to be used in emergencies. The presence of this device will trigger \fBreboot\fR, \fBpoweroff\fR and/or the panic function, depending on whether \fBreboot\fR, \fBpoweroff\fR, and/or \fBserious\fR are specified.
2018-03-28 02:34:52 +00:00
.PD 0
.PP
.PD 1
2018-03-28 20:15:20 +00:00
The device must be GPT-formatted and contain at least one partition\&.
The UUID of a GPT-formatted device looks like "12345678-9ABC-DEF0-1234-56789ABCDEF0"\&.
2018-03-28 02:34:52 +00:00
.PP
2018-03-28 03:07:39 +00:00
See \fBHOW TO DETERMINE MY UUIDS\fR for details\&.
2018-03-28 02:34:52 +00:00
.RE
.PP
\fBreboot\fR (recommended)
.RS 4
2018-03-28 03:07:39 +00:00
Indicates that the system should reboot upon encountering the device specified with \fBreject\fR\&.
2018-03-28 02:34:52 +00:00
.PP
2018-03-28 03:07:39 +00:00
If \fBpoweroff\fR is also specified, \fBreboot\fR will be ignored\&.
2018-03-28 02:34:52 +00:00
.RE
.PP
\fBpoweroff\fR
.RS 4
2018-03-28 03:07:39 +00:00
Indicates that the system should shut down upon encountering the device specified with \fBreject\fR\&.
This option is discouraged for security reasons\&.
2018-03-28 02:34:52 +00:00
.RE
.PP
\fBserious=\fR\fB\fIUUID\fR\fR
.RS 4
2018-03-28 03:07:39 +00:00
The UUID of the device containing the LUKS header to erase upon encountering the device specified with \fBreject\fR\&.
2018-03-31 23:53:41 +00:00
Erasing the LUKS header will render the data unreadable\&.
2018-03-28 02:34:52 +00:00
.PP
2018-03-28 03:07:39 +00:00
NOTE: You should make a backup of the LUKS header before using this function\&.
2018-03-28 02:34:52 +00:00
.RE
.PP
2018-03-28 03:07:39 +00:00
.SH "USAGE"
2018-03-28 02:34:52 +00:00
.PP
2018-03-28 03:07:39 +00:00
To activate the module you have to configure PAM\&. See \fBpam\&.conf(5)\fR for details\&.
2018-03-28 02:34:52 +00:00
.PP
2018-03-28 03:07:39 +00:00
In general, you will want to add the following to the top of a PAM configuration file:
2018-03-28 02:34:52 +00:00
.PD 0
.RS 4
2018-03-28 03:07:39 +00:00
auth requisite pam_panic\&.so auth=<UUID> reject=<UUID> reboot serious=<UUID>
2018-03-28 02:34:52 +00:00
.PP
2018-03-28 03:07:39 +00:00
account requisite pam_panic\&.so
2018-03-28 02:34:52 +00:00
.RE
2018-03-31 23:53:41 +00:00
Or:
.RS 4
auth requisite pam_panic.so password reboot serious=<UUID>
.PP
account requisite pam_panic.so
.RE
2018-03-28 02:34:52 +00:00
.PD 1
.SH "HOW TO DETERMINE MY UUIDS"
.PP
You will find your UUIDs in \fI/dev/disk/by-partuuid\fR\&.
You might want to execute "\fBls -l /dev/disk/by-partuuid/\fR" in your favourite shell to find out which UUID is which device\&.
.SH "RETURN VALUES"
.PP
PAM_SUCCESS
.RS 4
Access was granted\&.
.RE
.PP
PAM_IGNORE
.RS 4
2018-03-28 03:07:39 +00:00
An error has occured\&. The module will be ignored.\&.
2018-03-28 02:34:52 +00:00
.RE
.PP
PAM_MAXTRIES
.RS 4
2018-03-28 03:07:39 +00:00
The removable media was not detected\&.
2018-03-28 02:34:52 +00:00
.RE
.SH "FILES"
.PP
/lib/*/security/pam_panic\&.so
.RS 4
2018-03-28 03:38:47 +00:00
This PAM module\&.
2018-03-28 02:34:52 +00:00
.RE
2018-03-31 23:53:41 +00:00
.PP
/usr/local/bin/pam_panic_pw
.RS 4
Program to set and change the passwords\&.
.RE
2018-03-28 02:34:52 +00:00
.SH "BUGS"
.PP
2018-03-28 03:07:39 +00:00
Please report bugs and send pull requests to <https://github\&.com/Bandie/pam_panic>\&.
2018-03-28 02:34:52 +00:00
.SH "SEE ALSO"
.PP
2018-03-31 23:53:41 +00:00
\fBpam_panic_pw\fR(1),
\fBcryptsetup\fR(8),
\fBpam\fR(8),
\fBpam\&.conf\fR(5)
2018-03-28 02:34:52 +00:00
.SH "AUTHORS"
.PD 0
.PP
2018-03-28 03:07:39 +00:00
pam_panic was written by Bandie <bandie@chaospott\&.de>\&.
2018-03-28 02:34:52 +00:00
.PP
2018-03-28 03:07:39 +00:00
This man page has been revised by Jordy Dickinson <jordy\&.dickinson@icloud\&.com>