On Thursday 28 January 2010 00:04:46 Mick wrote: > On Wednesday 27 January 2010 11:01:52 Willie Wong wrote: > > On Tue, Jan 26, 2010 at 04:34:56PM -0800, walt wrote: > > > After thinking awhile I realized that pam can be used to > > > combine muliple forms of authentication to reduce the well > > > documented risk of single-factor authentication (like our > > > traditional password system). > > > > > > Example: if I have an ordinary password, plus an ssh key > > > stored on a USB stick, plus a biometric device like an > > > eye scanner or a fingerprint scanner, I can then use any > > > or all of those methods to identify myself to the system > > > by configuring pam in the appropriate way. > > > > Yes. > > > > First look at the PAM configuration section of this: > > > > http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader#Login_ > >vi a_pam_bioapi > > > > Now if instead of having > > > > auth sufficient pam_unix.so ... > > auth sufficient pam_bioapi.so ... > > > > which says that either password log-in OR fingerprint scanner is > > enough, you change the first line to "auth required ...", per the docs > > > > http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration > >-f ile.html > > > > you will then have a behaviour where BOTH password and fingerprint is > > involved. I think PAM is a Pretty Good Idea and its implementation is > > Very Cool, but I also think it is completely unnecessary on _my_ > > laptop. > > What would be the pam-way to only allow remote ssh logins using pubkeys and > completely forbid ssh paswd? I used to remove allow pam from sshd_config. > Is there a better pam-centric way of doing the same thing?
That's pretty pointless. pam doesn't know how to do openssl voodoo magic. sshd does. -- alan dot mckinnon at gmail dot com
