Ludovic Rousseau wrote:
On 17/10/06, Shawn Willden <[EMAIL PROTECTED]> wrote:
On Tuesday 17 October 2006 01:13, Ludovic Rousseau wrote:
> How can you differentiate, at the system level, a local user from a
remote
> user?
I don't think you need to distinguish a user at the console from the same user
account coming in over a remote connection. What Mr Engert wants to achieve
is to ensure that when a user logs into the console, only that user account
has access to the smart card. Since the display manager obviously knows who
is logged in at the console, that should be achievable.
Yes that would be acceptable.
What you could do is add a PAM module that changes the permission of
the /var/run/pcscd.* file.
You should also manage the case when two users are logged using two
local X servers or from two local virtual text consoles: only the
first user (uid) will have access to the smart card.
At the logout the same PAM module would change the permissions back to
their original states.
There are a lot of other devices which need to be usable only by the
user at the console: speaker, microphone, thumb drive, scanner, camera
as well as the keyboard, and mouse.
There appears to be a number of approaches to handling this.
Linux has "udev" and "hal", that create devices and assign names and
permissions to these dynamic devices.
There is also pam_foreground and pam_console that try to identify
the user that is at the console, and create a /var/run/console/
entry for the user.
The pam_group can add groups to a session. (But there is a
security problem with this if the user creates a setgid program
while at the console, then misuses it at a later time.)
On Ubuntu Edgy that I am working with since it has OpenSC-0.11.1
the /var/run/console appears to be created. But did not delete it
when I logged off, and on with a different user.
I am still looking to see how these are used.
Such a solution would work even without modifying pcsc-lite.
That would be nice.
But keep in mind that you may have a hardware crypto device
for the system and a smartcard reader for the user, both serviced
by pcscd. In this case you may want to control access at the reader
level rather then the pcscd socket level.
Bye,
--
Douglas E. Engert <[EMAIL PROTECTED]>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
_______________________________________________
Muscle mailing list
Muscle@lists.musclecard.com
http://lists.drizzle.com/mailman/listinfo/muscle
