Creating gz with Make
This commit is contained in:
parent
ee99adfc7e
commit
3c0075d444
GPG Key ID:
C1E133BC65A822DD
5
Makefile
5
Makefile
|
|
@ -18,6 +18,9 @@ clean:
|
|||
detect_pamdir:
|
||||
@for d in $(POSSIBLE_PAMDIRS); do if [ ! -d $${d} ]; then continue; else printf "$${d}\n"; fi; done
|
||||
|
||||
install_docs:
|
||||
cd man && for f in `find . -name pam_panic.8 | sed 's/\/pam_panic.8//'`; do gzip -9 -c $${f}/pam_panic.8 > /usr/share/man/$${f}/pam_panic.8.gz; done
|
||||
|
||||
uninstall:
|
||||
PAMDIR=$(PAMDIR); rm $${PAMDIR}/pam_panic.so
|
||||
rm /usr/share/man/*/pam_panic.8.gz
|
||||
|
|
@ -25,5 +28,5 @@ uninstall:
|
|||
|
||||
install:
|
||||
PAMDIR=$(PAMDIR); if [ -z $${PAMDIR} ]; then printf "Error: PAM's shared object directory was not detected. If you know where it is, please add to POSSIBLE_PAMDIRS and make a pull request.\n"&& exit 1; else cp build/pam_panic.so $${PAMDIR}/pam_panic.so; fi
|
||||
if [ ! -d /usr/share/man ]; then printf "Error: Where is the manpage directory?\n" && exit 1; else cp -r man/* /usr/share/man/.; fi
|
||||
if [ ! -d /usr/share/man ]; then printf "Error: Where is the manpage directory?\n" && exit 1; else make install_docs; fi
|
||||
@printf "Done!\n"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,166 @@
|
|||
'\" t
|
||||
.\" Title: pam_panic
|
||||
.\" Author: [see the "AUTHORS" section]
|
||||
.\" Date: 2018-03-26
|
||||
.\" Manual: PAM Panic Manual
|
||||
.\" Source: PAM Panic Manual
|
||||
.\" Language: German
|
||||
.\"
|
||||
.TH "PAM_PANIC" "8" "2018-03-26" "PAM Panic Manual" "PAM Panic Manual"
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
|
||||
.SH "NAME"
|
||||
pam_panic \- PAM module zur Authentifizierung durch Wechseldatentr\(:agern mit Panik-Funktion
|
||||
|
||||
|
||||
.SH "\(:UBERSICHT"
|
||||
.HP \w'\fBpam_panic\&.so\fR\ 'u
|
||||
\fBpam_panic\&.so\fR [allow=\fIUUID(GPT)\fR] [reject=\fIUUID(GPT)\fR] [reboot] [poweroff] [serious=\fIUUID\fR]
|
||||
|
||||
|
||||
.SH "BESCHREIBUNG"
|
||||
.PP
|
||||
Das pam_panic PAM module wurde mit dem Hintergedanken entwickelt, Personen mit wichtigen Daten zu sch\(:utzen.\&. Es bietet eine Panik-Function\&.
|
||||
.PP
|
||||
Man verwendet zwei Wecheldatentr\(:ager, die als Schl\(:ussel dienen\&.
|
||||
Hierbei funktioniert eines als Authentifizierungsschl\(:ussel und eines als Panikschl\(:ussel\&.
|
||||
Der Panikschl\(:ussel ruft die Panik-Funktion auf, die, sofern die Option \fBserious\fR aktiviert wurde, "\fBcryptsetup luksErase [UUID]\fR" ausf\(:uhrt\&.
|
||||
Dieses wird dann den luksHeader zerst\(:oren\&.
|
||||
Das hei\(sst, dass die Daten auf den in den Optionen angegebenen Datentr\(:ager f\(:ur niemanden mehr lesbar sein werden\&.
|
||||
|
||||
|
||||
.SH "OPTIONEN"
|
||||
.PP
|
||||
\fBallow=\fR\fB\fIUUID(GPT)\fR\fR (erforderlich)
|
||||
.RS 4
|
||||
Diese Ger\(:ate-UUID wird zur Authentifizierung benutzt (Authentifierungsschl\(:ussel)\&.
|
||||
.PD 0
|
||||
.PP
|
||||
.PD 1
|
||||
Es ist notwendig, dass ein GPT-formatierter Wecheldatentr\(:ager mit mindestens einer Partition benutzt wird\&.
|
||||
Die UUID eines GPT-formatierten Ger\(:ates sieht beispielsweise so aus: "12345678-9ABC-DEF0-1234-56789ABCDEF0"\&.
|
||||
.PP
|
||||
Weitere Informationen im Abschnitt \fBWIE BESTIMME ICH MEINE UUIDS\fR\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBreject=\fR\fB\fIUUID(GPT)\fR\fR (erforderlich)
|
||||
.RS 4
|
||||
Diese Ger\(:ate-UUID wird \fBreboot\fR, \fBpoweroff\fR und/oder die Panik-Funktion \fBserious\fR, sofern als Argument angegeben, aufrufen\& (Panikschl\(:ussel).
|
||||
.PD 0
|
||||
.PP
|
||||
.PD 1
|
||||
Es ist notwendig, dass ein GPT-formatierter Wecheldatentr\(:ager mit mindestens einer Partition benutzt wird\&.
|
||||
Die UUID eines GPT-formatierten Ger\(:ates sieht beispielsweise so aus: "12345678-9ABC-DEF0-1234-56789ABCDEF0"\&.
|
||||
.PP
|
||||
Weitere Informationen im Abschnitt \fBWIE BESTIMME ICH MEINE UUIDS\fR\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBreboot\fR (empfohlen)
|
||||
.RS 4
|
||||
Wenn dieses Argument angegeben wird, wird das System neu gestartet, sobald der Wecheldatentr\(:ager mit der UUID des Arguments \fBreject=UUID(GPT)\fR eingelegt wurde\&.
|
||||
Diese Option wird empfohlen\&.
|
||||
.PP
|
||||
Wenn \fBpoweroff\fR ebenfalls als Argument angegeben wird, wird \fBreboot\fR ignoriert\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBpoweroff\fR
|
||||
.RS 4
|
||||
Wenn dieses Argument angegeben wird, wird das System heruntergefahren, sobald der Wecheldatentr\(:ager mit der UUID des Arguments \fBreject=UUID(GPT)\fR eingelegt wurde\&.
|
||||
Aus Sicherheitsgr\(:unden wird von dieser Option abgeraten\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBserious=\fR\fB\fIUUID\fR\fR
|
||||
.RS 4
|
||||
Die Ger\(:ate-UUID, bei dem der luksHeaders zerst\(:ort werden w\(:urde, sobald der Wecheldatentr\(:ager mit der UUID des Arguments \fBreject=UUID(GPT)\fR eingelegt wurde\&.
|
||||
.PP
|
||||
(Eine Erinnerung daran, ein luksHeader-Backup zu machen bevor diese Funktion benutzt wird.\&.)
|
||||
.RE
|
||||
.PP
|
||||
|
||||
|
||||
.SH "WIE WENDE ICH ES AN"
|
||||
.PP
|
||||
Um das Modul anzuwenden, m\(:ussen eine oder mehrere Dateien in \fI/etc/pam.d/\fR\& ver\(:andert werden\&.
|
||||
Dort sind verschiendene (Dienst-)Programme und andere Konfigurationsdateien ersichtlich, die das PAM modul verwenden\&.
|
||||
Falls Ubuntu verwendet wird, so k\(:onnte die Datei "\fIcommon-auth\fR" interessant sein.
|
||||
Informationen zur Handhabung der pam.d-Konfigurationsdateien ist es anzuraten, das Wiki der jeweiligen Distribution zu konsultieren\&.
|
||||
.PP
|
||||
Man f\(:uge folgende beispielhafte Zeilen am Anfang einer Konfigurationsdatei hinzu:
|
||||
.PD 0
|
||||
.RS 4
|
||||
auth requisite pam_panic.so auth=<UUID> reject=<UUID> reboot serious=<UUID>
|
||||
.PP
|
||||
account requisite pam_panic.so
|
||||
.RE
|
||||
.PD 1
|
||||
|
||||
|
||||
.SH "WIE BESTIMME ICH MEINE UUIDS"
|
||||
.PP
|
||||
Die UUIDs k\(:onnen unter \fI/dev/disk/by-partuuid\fR gefunden werden\&.
|
||||
Um nachvollziehen zu k\(:onnen, welcher Wecheldatentr\(:ager welches ist, ist es ratsam "\fBls -l /dev/disk/by-partuuid/\fR" in der Lieblingsshell auszuf\(:uhren\&.
|
||||
|
||||
|
||||
.SH "R\(:UCKGABEWERTE"
|
||||
.PP
|
||||
PAM_SUCCESS
|
||||
.RS 4
|
||||
Zugriff wurde gew\(:ahrt.\&.
|
||||
.RE
|
||||
.PP
|
||||
PAM_IGNORE
|
||||
.RS 4
|
||||
Ein Fehler ist aufgetreten\&. Dieses Modul wird ignoriert\&.
|
||||
.RE
|
||||
.PP
|
||||
PAM_MAXTRIES
|
||||
.RS 4
|
||||
Der Wecheldatentr\(:ager wurde nicht erkannt\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "DATEIEN"
|
||||
.PP
|
||||
/lib/*/security/pam_panic\&.so
|
||||
.RS 4
|
||||
Shared object-Datei, die f\(:ur alles zust\(:andig ist\&.
|
||||
.RE
|
||||
.PP
|
||||
/usr/share/man/*/man8/pam_panic\&.8\&.gz
|
||||
.RS 4
|
||||
Die Manpages\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Fehlerberichte (m\(:oglichst auf Englisch) und Codeverbesserungen k\(:onnen hier eingereicht werden: https://github.com/Bandie/pam_panic
|
||||
|
||||
|
||||
.SH "SIEHE AUCH"
|
||||
.PP
|
||||
\fBcryptsetup\fR(8),
|
||||
\fBpam.d\fR(5),
|
||||
\fBpam\fR(8)\&.
|
||||
|
||||
|
||||
.SH "AUTOREN"
|
||||
|
||||
.PD 0
|
||||
.PP
|
||||
Dieses pam_panic PAM Modul wurde durch Bandie <bandie@chaospott\&.de> entwickelt\&.
|
||||
Binary file not shown.
|
|
@ -0,0 +1,166 @@
|
|||
'\" t
|
||||
.\" Title: pam_panic
|
||||
.\" Author: [see the "AUTHORS" section]
|
||||
.\" Date: 2018-03-26
|
||||
.\" Manual: Linux-PAM Panic Manual
|
||||
.\" Source: Linux-PAM Panic Manual
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PAM_PANIC" "8" "2018-03-26" "PAM Panic Manual" "PAM Panic Manual"
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
|
||||
|
||||
.SH "NAME"
|
||||
pam_panic \- PAM module for access control using removable media. With panic function
|
||||
|
||||
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpam_panic\&.so\fR\ 'u
|
||||
\fBpam_panic\&.so\fR [allow=\fIUUID(GPT)\fR] [reject=\fIUUID(GPT)\fR] [reboot] [poweroff] [serious=\fIUUID\fR]
|
||||
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The pam_panic PAM module shall protect people who have value data on their computer\&. It provides a panic function\&.
|
||||
.PP
|
||||
There are two removable media which work as keys: One is the auth key and one is the panic key\&.
|
||||
The auth key will let you pass to the password prompt\&.
|
||||
The panic key will call the panic function which, if configured, executes "\fBcryptsetup luksErase [UUID]\fR"\&. This will destroy the luksHeader safely\&.
|
||||
It means that your data will not be readable to anyone anymore\&.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\fBallow=\fR\fB\fIUUID(GPT)\fR\fR (required)
|
||||
.RS 4
|
||||
This device UUID is used for authentication (auth key)\&.
|
||||
.PD 0
|
||||
.PP
|
||||
.PD 1
|
||||
It is required to have a GPT formated device with at least one partition on it\&.
|
||||
The UUID of a GPT formated device looks like "12345678-9ABC-DEF0-1234-56789ABCDEF0"\&.
|
||||
.PP
|
||||
See more in the section \fBHOW TO DETERMINE MY UUIDS\fR\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBreject=\fR\fB\fIUUID(GPT)\fR\fR (required)
|
||||
.RS 4
|
||||
This device UUID will cause calling \fBreboot\fR, \fBpoweroff\fR and/or the panic function \fBserious\fR if stated before (panic key)\&.
|
||||
.PD 0
|
||||
.PP
|
||||
.PD 1
|
||||
It is required to have a GPT formated device with at least one partition on it\&.
|
||||
The UUID of a GPT formated device looks like "12345678-9ABC-DEF0-1234-56789ABCDEF0"\&.
|
||||
.PP
|
||||
See more in the section \fBHOW TO DETERMINE MY UUIDS\fR\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBreboot\fR (recommended)
|
||||
.RS 4
|
||||
Stating this argument will cause a reboot after the device stated in \fBreject=UUID(GPT)\fR has been inserted\&.
|
||||
You might want that option\&.
|
||||
.PP
|
||||
If \fBpoweroff\fR is also stated the argument \fBreboot\fR will be ignored\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBpoweroff\fR
|
||||
.RS 4
|
||||
Stating this argument will cause a shutdown after the device stated in \fBreject=UUID(GPT)\fR has been inserted\&.
|
||||
For security reasons you should abstrain from this option\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBserious=\fR\fB\fIUUID\fR\fR
|
||||
.RS 4
|
||||
The device UUID of which the luksHeaders will be erased if the device stated in \fBreject=UUID(GPT)\fR has been inserted\&.
|
||||
.PP
|
||||
(You should make a luksHeader backup before using this function\&.)
|
||||
.RE
|
||||
.PP
|
||||
|
||||
|
||||
.SH "HOW DO I USE IT"
|
||||
.PP
|
||||
To activate the module you have to change some file(s) in \fI/etc/pam.d/\fR\&.
|
||||
There you'll see different services, programs and other config files which use the PAM modules\&.
|
||||
Speaking of the general authentication configs, if you use Ubuntu "\fIcommon-auth\fR" might be interesting for you\&.
|
||||
For other distributions you might want to look into the distribution's wiki\&.
|
||||
.PP
|
||||
Put the following lines on top of the config file:
|
||||
.PD 0
|
||||
.RS 4
|
||||
auth requisite pam_panic.so auth=<UUID> reject=<UUID> reboot serious=<UUID>
|
||||
.PP
|
||||
account requisite pam_panic.so
|
||||
.RE
|
||||
.PD 1
|
||||
|
||||
|
||||
.SH "HOW TO DETERMINE MY UUIDS"
|
||||
.PP
|
||||
You will find your UUIDs in \fI/dev/disk/by-partuuid\fR\&.
|
||||
You might want to execute "\fBls -l /dev/disk/by-partuuid/\fR" in your favourite shell to find out which UUID is which device\&.
|
||||
|
||||
|
||||
.SH "RETURN VALUES"
|
||||
.PP
|
||||
PAM_SUCCESS
|
||||
.RS 4
|
||||
Access was granted\&.
|
||||
.RE
|
||||
.PP
|
||||
PAM_IGNORE
|
||||
.RS 4
|
||||
An error has occured\&. This module will been ignored.\&.
|
||||
.RE
|
||||
.PP
|
||||
PAM_MAXTRIES
|
||||
.RS 4
|
||||
The removable media has not been detected\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "FILES"
|
||||
.PP
|
||||
/lib/*/security/pam_panic\&.so
|
||||
.RS 4
|
||||
Shared object file which does all the work\&.
|
||||
.RE
|
||||
.PP
|
||||
/usr/share/man/*/man8/pam_panic\&.8\&.gz
|
||||
.RS 4
|
||||
The man pages\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Please report bugs or do merge requests at https://github.com/Bandie/pam_panic
|
||||
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
\fBcryptsetup\fR(8),
|
||||
\fBpam.d\fR(5),
|
||||
\fBpam\fR(8)\&.
|
||||
|
||||
|
||||
.SH "AUTHORS"
|
||||
.PD 0
|
||||
.PP
|
||||
This pam_panic PAM module was developed by Bandie <bandie@chaospott\&.de>\&.
|
||||
.PP
|
||||
This man page has been revised by
|
||||
Binary file not shown.
Loading…
Reference in New Issue