Password function
This commit is contained in:
11
man/Makefile
11
man/Makefile
@ -1,2 +1,11 @@
|
||||
install:
|
||||
.PHONY: man1 man8
|
||||
|
||||
man1:
|
||||
for f in `find . -name pam_panic_pw.1 | sed 's/\/pam_panic_pw.1//'`; do gzip -9 -c $${f}/pam_panic_pw.1 > $(MANDIR)/$${f}/pam_panic_pw.1.gz; done
|
||||
|
||||
man8:
|
||||
for f in `find . -name pam_panic.8 | sed 's/\/pam_panic.8//'`; do gzip -9 -c $${f}/pam_panic.8 > $(MANDIR)/$${f}/pam_panic.8.gz; done
|
||||
|
||||
install:
|
||||
make man1
|
||||
make man8
|
||||
|
||||
89
man/de/man1/pam_panic_pw.1
Normal file
89
man/de/man1/pam_panic_pw.1
Normal file
@ -0,0 +1,89 @@
|
||||
'\" t
|
||||
.\" Title: pam_panic_pw
|
||||
.\" Author: [see the "AUTHORS" section]
|
||||
.\" Date: 2018-03-31
|
||||
.\" Manual: PAM Panic Manual
|
||||
.\" Source: PAM Panic Manual
|
||||
.\" Language: German
|
||||
.\"
|
||||
.TH "PAM_PANIC_PW" "8" "2018-03-31" "PAM Panic Handbuch" "PAM Panic Handbuch"
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
|
||||
.SH "NAME"
|
||||
pam_panic_pw \- Setzen der Passw\(:orter f\(:ur das \fBpam_panic\fR(8) PAM Modul\&.
|
||||
|
||||
|
||||
.SH "\(:UBERSICHT"
|
||||
.HP \w'\fBpam_panic_pw\fR\ 'u
|
||||
\fBpam_panic_pw\fR
|
||||
|
||||
|
||||
.SH "BESCHREIBUNG"
|
||||
.PP
|
||||
Es setzt die Passw\(:orter f\(:ur das \fBpam_panic\fR(8) PAM Modul\&.
|
||||
.PP
|
||||
Dabei gibt es das "Key password" und das "Panic password"\&.
|
||||
Das "Key password" dient zur normalen Authentifizierung
|
||||
w\(:ahrend das "Panic password" die Panikfunktion ausf\(:uhrt\&.
|
||||
|
||||
|
||||
.SH "R\(:UCKGABEWERTE"
|
||||
.PP
|
||||
0
|
||||
.RS 4
|
||||
Passw\(:orter erfolgreich gesetzt\&.
|
||||
.RE
|
||||
.PP
|
||||
1
|
||||
.RS 4
|
||||
Keine Berechtigung\&.
|
||||
.RE
|
||||
.PP
|
||||
2
|
||||
.RS 4
|
||||
Die Passwortdatei konnte nicht ge\(:offnet werden\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "DATEIEN"
|
||||
.PP
|
||||
/usr/local/bin/pam_panic_pw
|
||||
.RS 4
|
||||
Programm zum Setzen und Ver\(:andern der Passw\(:orter\&.
|
||||
.RE
|
||||
.PP
|
||||
/var/lib/pam_panic/auth
|
||||
.RS 4
|
||||
Die Passwortdatei\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Fehlerberichte (m\(:oglichst auf Englisch) und Codeverbesserungen k\(:onnen hier eingereicht werden: https://github.com/Bandie/pam_panic
|
||||
|
||||
|
||||
.SH "SIEHE AUCH"
|
||||
.PP
|
||||
\fBpam_panic\fR(8),
|
||||
\fBcryptsetup\fR(8),
|
||||
\fBpam\&.conf\fR(5),
|
||||
\fBpam\fR(8)\&.
|
||||
|
||||
|
||||
.SH "AUTOREN"
|
||||
|
||||
.PD 0
|
||||
.PP
|
||||
Dieses pam_panic PAM Modul wurde durch Bandie <bandie@chaospott\&.de> entwickelt\&.
|
||||
@ -1,12 +1,12 @@
|
||||
'\" t
|
||||
.\" Title: pam_panic
|
||||
.\" Author: [see the "AUTHORS" section]
|
||||
.\" Date: 2018-03-26
|
||||
.\" Date: 2018-03-31
|
||||
.\" Manual: PAM Panic Manual
|
||||
.\" Source: PAM Panic Manual
|
||||
.\" Language: German
|
||||
.\"
|
||||
.TH "PAM_PANIC" "8" "2018-03-26" "PAM Panic Manual" "PAM Panic Manual"
|
||||
.TH "PAM_PANIC" "8" "2018-03-31" "PAM Panic Handbuch" "PAM Panic Handbuch"
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
@ -21,28 +21,62 @@
|
||||
.\" -----------------------------------------------------------------
|
||||
|
||||
.SH "NAME"
|
||||
pam_panic \- PAM module zur Authentifizierung durch Wechseldatentr\(:agern mit Panik-Funktion
|
||||
pam_panic \- PAM-Modul mit Panik-Funktion zum Sch\(:utzen von wichtigen Daten in Notsituationen
|
||||
|
||||
|
||||
.SH "\(:UBERSICHT"
|
||||
.HP \w'\fBpam_panic\&.so\fR\ 'u
|
||||
\fBpam_panic\&.so\fR [allow=\fIUUID(GPT)\fR] [reject=\fIUUID(GPT)\fR] [reboot] [poweroff] [serious=\fIUUID\fR]
|
||||
\fBpam_panic\&.so\fR [password] [allow=\fIUUID(GPT)\fR] [reject=\fIUUID(GPT)\fR] [reboot] [poweroff] [serious=\fIUUID\fR]
|
||||
|
||||
|
||||
.SH "BESCHREIBUNG"
|
||||
.PP
|
||||
Das pam_panic PAM module wurde mit dem Hintergedanken entwickelt, Personen mit wichtigen Daten zu sch\(:utzen.\&. Es bietet eine Panik-Function\&.
|
||||
Das pam_panic PAM Modul wurde mit dem Hintergedanken entwickelt, Personen mit wichtigen Daten zu sch\(:utzen\&. Es bietet eine Panik-Funktion\&.
|
||||
.PP
|
||||
Es gibt zwei M\(:oglichkeiten der Verwendung:
|
||||
.PD 0
|
||||
.PP
|
||||
Erste M\(:oglichkeit:
|
||||
.RS 2
|
||||
Man verwendet zwei Wecheldatentr\(:ager, die als Schl\(:ussel dienen\&.
|
||||
Hierbei funktioniert eines als Authentifizierungsschl\(:ussel und eines als Panikschl\(:ussel\&.
|
||||
Der Panikschl\(:ussel ruft die Panik-Funktion auf, die, sofern die Option \fBserious\fR aktiviert wurde, "\fBcryptsetup luksErase [UUID]\fR" ausf\(:uhrt\&.
|
||||
Dieses wird dann den luksHeader zerst\(:oren\&.
|
||||
Das hei\(sst, dass die Daten auf den in den Optionen angegebenen Datentr\(:ager f\(:ur niemanden mehr lesbar sein werden\&.
|
||||
Der Panikschl\(:ussel f\(:uhrt die \fIPanikfunktion\fR aus\&.
|
||||
.PD 0
|
||||
.PP
|
||||
Siehe dazu die Optionen \fBallow\fR und \fBreject\fR\&.
|
||||
.RE
|
||||
.PP
|
||||
Zweite M\(:oglichkeit:
|
||||
.RS 2
|
||||
Man verwendet zwei Passw\(:orter, die als Schl\(:ussel dienen\&.
|
||||
Dabei wird ein Schl\(:usselpasswort (Key password) und ein Panikpasswort (Panic password) festgelegt\&.
|
||||
Das Panikpasswort wird hierbei die \fIPanikfunktion\fR aufrufen\&.
|
||||
.PD 0
|
||||
.PP
|
||||
Siehe dazu die Option \fBpassword\fR\&.
|
||||
.RE
|
||||
|
||||
.PD 1
|
||||
.PP
|
||||
Die Panikfunktion:
|
||||
.RS 2
|
||||
Das Verhalten der Panikfunktion wird durch die Argumente \fBreboot\fR, \fBpoweroff\fR und/oder \fBserious\fR definiert\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "OPTIONEN"
|
||||
.PP
|
||||
\fBallow=\fR\fB\fIUUID(GPT)\fR\fR (erforderlich)
|
||||
\fBpassword\fR
|
||||
.RS 4
|
||||
Diese Option aktiviert die Passwortfunktion mit einem Panikpasswort und einem Schl\(:usselpasswort. Wenn \fBallow\fR und \fBreject\fR gesetzt sind, wird diese Option ignoriert.
|
||||
.PD 0
|
||||
.PP
|
||||
.PD 1
|
||||
Um die Passw\(:orter zu setzen steht das Programm \fBpam_panic_pw\fR(1) zur Verf\(:ugung.
|
||||
.RE
|
||||
|
||||
.PP
|
||||
\fBallow=\fR\fB\fIUUID(GPT)\fR\fR
|
||||
.RS 4
|
||||
Diese Ger\(:ate-UUID wird zur Authentifizierung benutzt (Authentifierungsschl\(:ussel)\&.
|
||||
.PD 0
|
||||
@ -55,7 +89,7 @@ Weitere Informationen im Abschnitt \fBWIE BESTIMME ICH MEINE UUIDS\fR\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBreject=\fR\fB\fIUUID(GPT)\fR\fR (erforderlich)
|
||||
\fBreject=\fR\fB\fIUUID(GPT)\fR\fR
|
||||
.RS 4
|
||||
Diese Ger\(:ate-UUID wird \fBreboot\fR, \fBpoweroff\fR und/oder die Panik-Funktion \fBserious\fR, sofern als Argument angegeben, aufrufen\& (Panikschl\(:ussel).
|
||||
.PD 0
|
||||
@ -86,7 +120,12 @@ Aus Sicherheitsgr\(:unden wird von dieser Option abgeraten\&.
|
||||
|
||||
\fBserious=\fR\fB\fIUUID\fR\fR
|
||||
.RS 4
|
||||
Die Ger\(:ate-UUID, bei dem der luksHeaders zerst\(:ort werden w\(:urde, sobald der Wecheldatentr\(:ager mit der UUID des Arguments \fBreject=UUID(GPT)\fR eingelegt wurde\&.
|
||||
Die Ger\(:ate-UUID, dessen luksHeaders zerst\(:ort werden w\(:urde, sobald der Wecheldatentr\(:ager mit der UUID des Arguments \fBreject=UUID(GPT)\fR eingelegt wurde\&.
|
||||
Das hei\(sst, dass die Daten auf den in den Optionen angegebenen Datentr\(:ager f\(:ur niemanden mehr lesbar sein werden\&.
|
||||
.PD 0
|
||||
.PP
|
||||
Intern wird das Programm "\fBcryptsetup luksErase [UUID]\fR" ausgef\(:uhrt\&.
|
||||
.PD 1
|
||||
.PP
|
||||
(Eine Erinnerung daran, ein luksHeader-Backup zu machen bevor diese Funktion benutzt wird.\&.)
|
||||
.RE
|
||||
@ -104,6 +143,12 @@ auth requisite pam_panic.so auth=<UUID> reject=<UUID> reboot serious=<U
|
||||
.PP
|
||||
account requisite pam_panic.so
|
||||
.RE
|
||||
Oder auch:
|
||||
.RS 4
|
||||
auth requisite pam_panic.so password reboot serious=<UUID>
|
||||
.PP
|
||||
account requisite pam_panic.so
|
||||
.RE
|
||||
.PD 1
|
||||
|
||||
|
||||
@ -117,7 +162,7 @@ Um nachvollziehen zu k\(:onnen, welcher Wecheldatentr\(:ager welches ist, ist es
|
||||
.PP
|
||||
PAM_SUCCESS
|
||||
.RS 4
|
||||
Zugriff wurde gew\(:ahrt.\&.
|
||||
Zugriff wurde gew\(:ahrt\&.
|
||||
.RE
|
||||
.PP
|
||||
PAM_IGNORE
|
||||
@ -138,9 +183,9 @@ Der Wecheldatentr\(:ager wurde nicht erkannt\&.
|
||||
Shared object-Datei, die f\(:ur alles zust\(:andig ist\&.
|
||||
.RE
|
||||
.PP
|
||||
/usr/share/man/*/man8/pam_panic\&.8\&.gz
|
||||
/usr/local/bin/pam_panic_pw
|
||||
.RS 4
|
||||
Die Manpages\&.
|
||||
Programm zum Setzen und Ver\(:andern der Passw\(:orter\&.
|
||||
.RE
|
||||
|
||||
|
||||
@ -151,6 +196,7 @@ Fehlerberichte (m\(:oglichst auf Englisch) und Codeverbesserungen k\(:onnen hier
|
||||
|
||||
.SH "SIEHE AUCH"
|
||||
.PP
|
||||
\fBpam_panic_pw\fR(1),
|
||||
\fBcryptsetup\fR(8),
|
||||
\fBpam\&.conf\fR(5),
|
||||
\fBpam\fR(8)\&.
|
||||
|
||||
92
man/man1/pam_panic_pw.1
Normal file
92
man/man1/pam_panic_pw.1
Normal file
@ -0,0 +1,92 @@
|
||||
'\" t
|
||||
.\" Title: pam_panic_pw
|
||||
.\" Author: [see the "AUTHORS" section]
|
||||
.\" Date: 2018-03-31
|
||||
.\" Manual: PAM Panic Manual
|
||||
.\" Source: PAM Panic Manual
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PAM_PANIC_PW" "8" "2018-03-31" "PAM Panic Manual" "PAM Panic Manual"
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
|
||||
.SH "NAME"
|
||||
pam_panic_pw \- Set and change the passwords for the \fBpam_panic\fR(8) PAM module\&.
|
||||
|
||||
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpam_panic_pw\fR\ 'u
|
||||
\fBpam_panic_pw\fR
|
||||
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
It sets the passwords for the \fBpam_panic\fR(8) PAM module\&.
|
||||
.PP
|
||||
There are two passwords: The "Key password" and the "Panic password"\&.
|
||||
The "Key password" is used for the normal authentication
|
||||
whereas the "Panic password" will execute the panic function\&.
|
||||
|
||||
|
||||
.SH "RETURN VALUES"
|
||||
.PP
|
||||
0
|
||||
.RS 4
|
||||
Passwords set successfully\&.
|
||||
.RE
|
||||
.PP
|
||||
1
|
||||
.RS 4
|
||||
Access denied\&.
|
||||
.RE
|
||||
.PP
|
||||
2
|
||||
.RS 4
|
||||
Could not open the password file\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "FILES"
|
||||
.PP
|
||||
/usr/local/bin/pam_panic_pw
|
||||
.RS 4
|
||||
Program to set and change the passwords\&.
|
||||
.RE
|
||||
.PP
|
||||
/var/lib/pam_panic/auth
|
||||
.RS 4
|
||||
The password file\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Fehlerberichte (m\(:oglichst auf Englisch) und Codeverbesserungen k\(:onnen hier eingereicht werden: https://github.com/Bandie/pam_panic
|
||||
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
\fBpam_panic\fR(8),
|
||||
\fBcryptsetup\fR(8),
|
||||
\fBpam\&.conf\fR(5),
|
||||
\fBpam\fR(8)\&.
|
||||
|
||||
|
||||
.SH "AUTHORS"
|
||||
|
||||
.PD 0
|
||||
.PP
|
||||
pam_panic was written by Bandie <bandie@chaospott\&.de>\&.
|
||||
.PP
|
||||
This man page has been revised by Jordy Dickinson <jordy\&.dickinson@icloud\&.com>
|
||||
|
||||
@ -22,23 +22,53 @@
|
||||
|
||||
|
||||
.SH "NAME"
|
||||
pam_panic \- PAM module for access control using removable media (with panic function)
|
||||
pam_panic \- PAM module with panic function to protect sensitive data in emergency situations
|
||||
|
||||
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpam_panic\&.so\fR\ 'u
|
||||
\fBpam_panic\&.so\fR [allow=\fIUUID(GPT)\fR] [reject=\fIUUID(GPT)\fR] [reboot] [poweroff] [serious=\fIUUID\fR]
|
||||
\fBpam_panic\&.so\fR [password] [allow=\fIUUID(GPT)\fR] [reject=\fIUUID(GPT)\fR] [reboot] [poweroff] [serious=\fIUUID\fR]
|
||||
|
||||
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The pam_panic PAM module protects sensitive data and provides a panic function for emergency situations\&.
|
||||
.PP
|
||||
There are two removable media which work as keys: the auth key and the panic key\&. The auth key will let you pass to the password prompt whereas the panic key, if provided, will securely erase the LUKS header, rendering the data unreadable\&.
|
||||
There are two possible options in how to use this PAM module:
|
||||
.PD 0
|
||||
.PP
|
||||
First possible option:
|
||||
.RS 2
|
||||
There are two removable media which work as keys: the auth key and the panic key\&.
|
||||
The auth key will let you pass to the password prompt whereas the panic key will execute the panic function\&.
|
||||
.RE
|
||||
Second possible option:
|
||||
.RS 2
|
||||
There are two passwords: the key password and the panic password\&. The key password will let you pass to the original password prompt whereas the panic password will execute the panic function\&.
|
||||
.RE
|
||||
|
||||
.PD 1
|
||||
.PP
|
||||
The panic function:
|
||||
.RS 2
|
||||
Its behaviour is defined through the arguments \fBreboot\fR, \fBpoweroff\fR and/or \fBserious\fR\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\fBallow=\fR\fB\fIUUID(GPT)\fR\fR (required)
|
||||
\fBpassword\fR
|
||||
.RS 4
|
||||
Activates the password function having a panic and key password\&.
|
||||
If the options \fBallow\fR and \fBreject\fR are provided this option will be ignored\&.
|
||||
.PD 0
|
||||
.PP
|
||||
To set the passwords the program \fBpam_panic_pw\fR(1) is provided\&.
|
||||
.RE
|
||||
.PD 1
|
||||
.PP
|
||||
|
||||
\fBallow=\fR\fB\fIUUID(GPT)\fR\fR
|
||||
.RS 4
|
||||
The UUID of the device to be used for authentication (the auth key)\&.
|
||||
.PD 0
|
||||
@ -51,7 +81,7 @@ See \fBHOW TO DETERMINE MY UUIDS\fR for details\&.
|
||||
.RE
|
||||
.PP
|
||||
|
||||
\fBreject=\fR\fB\fIUUID(GPT)\fR\fR (required)
|
||||
\fBreject=\fR\fB\fIUUID(GPT)\fR\fR
|
||||
.RS 4
|
||||
The UUID of the device to be used in emergencies. The presence of this device will trigger \fBreboot\fR, \fBpoweroff\fR and/or the panic function, depending on whether \fBreboot\fR, \fBpoweroff\fR, and/or \fBserious\fR are specified.
|
||||
.PD 0
|
||||
@ -82,6 +112,7 @@ This option is discouraged for security reasons\&.
|
||||
\fBserious=\fR\fB\fIUUID\fR\fR
|
||||
.RS 4
|
||||
The UUID of the device containing the LUKS header to erase upon encountering the device specified with \fBreject\fR\&.
|
||||
Erasing the LUKS header will render the data unreadable\&.
|
||||
.PP
|
||||
NOTE: You should make a backup of the LUKS header before using this function\&.
|
||||
.RE
|
||||
@ -99,6 +130,12 @@ auth requisite pam_panic\&.so auth=<UUID> reject=<UUID> reboot serious=
|
||||
.PP
|
||||
account requisite pam_panic\&.so
|
||||
.RE
|
||||
Or:
|
||||
.RS 4
|
||||
auth requisite pam_panic.so password reboot serious=<UUID>
|
||||
.PP
|
||||
account requisite pam_panic.so
|
||||
.RE
|
||||
.PD 1
|
||||
|
||||
|
||||
@ -132,6 +169,11 @@ The removable media was not detected\&.
|
||||
.RS 4
|
||||
This PAM module\&.
|
||||
.RE
|
||||
.PP
|
||||
/usr/local/bin/pam_panic_pw
|
||||
.RS 4
|
||||
Program to set and change the passwords\&.
|
||||
.RE
|
||||
|
||||
|
||||
.SH "BUGS"
|
||||
@ -141,7 +183,10 @@ Please report bugs and send pull requests to <https://github\&.com/Bandie/pam_pa
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
\fBcryptsetup\fR(8), \fBpam\fR(8), \fBpam\&.conf\fR(5)
|
||||
\fBpam_panic_pw\fR(1),
|
||||
\fBcryptsetup\fR(8),
|
||||
\fBpam\fR(8),
|
||||
\fBpam\&.conf\fR(5)
|
||||
|
||||
|
||||
.SH "AUTHORS"
|
||||
|
||||
Reference in New Issue
Block a user