Simplifying the login authentication process.

mikesd · 2009-09-09 08:22:44

At the moment when I boot my main workstation I go through the same process each time.

1. Enter passphrase for an encrypted data partition.
2. Enter username and password to login.
3. Enter passphrase for my SSH key to give me access to my home and work servers.

I know that with a bit of scripting I could combine 1 and 3 as the encrypted partition contains only data and is not needed for booting and could be unlocked manually without using /etc/crypttab. I would like to combine all three somehow so ideally I enter my username and a passphrase which gives me access to the machine itself and unlocks my encrypted partition and my SSH key. I have been googling around but haven't found anything yet. I'm guessing a solution would involve login or PAM but don't really know for sure. A simple solution would be for the login app to have the option of forwarding your password/passphrase to a user script though this does sound like a security risk which is probably why it isn't builtin. Anyone heard of something similar or know of a better way of doing this?

seiichiro0185 · 2009-09-09 09:54:02

you could use pam_ssh for unlocking the ssh-key and pam_mount for unlocking the data partition, there should be howtos somewhere that show how to configurre both of them to use your login password so you only need you normal login with user + password once

mikesd · 2009-09-09 10:11:37

Many thanks. I eventually found pam_mount mentioned in a tutorial but had not come across pam_ssh. Will definitely check them out. pam_ssh sounds exactly what I want:

This PAM module provides single sign-on behavior for SSH. The user types an SSH passphrase when logging in (probably to GDM, KDM, or XDM) and is authenticated if the passphrase successfully decrypts the user's SSH private key. In the PAM session phase, an ssh-agent process is started and keys are added. For the entire session, the user can SSH to other hosts that accept key authentication without typing any passwords.

This sounds like you can actually authenticate by successfully decrypting your ssh private key. Two birds with one stone.

Thanks.

Arch Linux

#1 2009-09-09 08:22:44

Simplifying the login authentication process.

#2 2009-09-09 09:54:02

Re: Simplifying the login authentication process.

#3 2009-09-09 10:11:37

Re: Simplifying the login authentication process.

Board footer