You are not logged in.
- Topics: Active | Unanswered
Pages: 1
#1 2019-05-27 22:44:15
- miomio
- Member
- Registered: 2016-01-17
- Posts: 167
[Solved] Disable TTY when xsecurelock
Is there a way to disable TTY's when screen is locked and re-enable them when screen is unlocked? Or would doing so be pointless even if possible?
Last edited by miomio (2019-05-27 23:43:30)
Offline
#2 2019-05-27 22:49:10
- Trilby
- Inspector Parrot
- Registered: 2011-11-29
- Posts: 30,530
- Website
Re: [Solved] Disable TTY when xsecurelock
Is it possible, yes. Is it possible with xsecurelock, no.
Use physlock. Or if there's some particular eye-candy you like from xsecurelock, use `physlock -l && xsecurelock && physlock -L`.
Note that xsecurelocks logic about security isn't very good. Physlock is far far less prone to any of the weaknesses noted in xsecurelock's readmy than xsecurelock is. In fact, if you use the above-noted chain of using both tools, you'll be less secure than just using physlock alone.
Last edited by Trilby (2019-05-27 22:52:22)
"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman
Offline
#3 2019-05-27 22:51:04
- 2ManyDogs
- Forum Fellow
- Registered: 2012-01-15
- Posts: 4,648
Re: [Solved] Disable TTY when xsecurelock
Did you search the web, the wiki, or this forum for possible solutions?
Offline
#4 2019-05-27 23:43:15
- miomio
- Member
- Registered: 2016-01-17
- Posts: 167
Re: [Solved] Disable TTY when xsecurelock
Did you search the web, the wiki, or this forum for possible solutions?
No.
Note that xsecurelocks logic about security isn't very good. Physlock is far far less prone to any of the weaknesses noted in xsecurelock's readmy than xsecurelock is. In fact, if you use the above-noted chain of using both tools, you'll be less secure than just using physlock alone.
That's a shame. Though physlock doesn't look like it can do anything else.... I'll use it, and give some thought to the weaknesses you (don't) mention. Thanks.
Last edited by miomio (2019-05-27 23:47:11)
Offline
#5 2019-05-27 23:58:23
- Trilby
- Inspector Parrot
- Registered: 2011-11-29
- Posts: 30,530
- Website
Re: [Solved] Disable TTY when xsecurelock
What else do you want it to do? It's a lock, it locks.
"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman
Offline
#6 2019-05-28 02:15:29
- miomio
- Member
- Registered: 2016-01-17
- Posts: 167
Re: [Solved] Disable TTY when xsecurelock
"Lock" is implemented different between physlock and xsecureloc, but if physlock capability was included in xsecurelock and xsecurelock cleaned up those weakspots you mention that'd be about it.
Last edited by miomio (2019-05-28 02:15:55)
Offline
#7 2019-05-28 02:31:37
- Trilby
- Inspector Parrot
- Registered: 2011-11-29
- Posts: 30,530
- Website
Re: [Solved] Disable TTY when xsecurelock
So use it as I described in the first reply to this thread and you'd have exactly what you want: whatever xsecurelock gives you within X, plus an actual lock on all other ttys.
"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman
Offline
#8 2019-05-28 13:25:15
- Nickolas0
- Member
- Registered: 2019-02-16
- Posts: 30
Re: [Solved] Disable TTY when xsecurelock
It's worth to keep in mind that:
Please also note, that the physlock executable will have root ownership and the setuid bit set.
So physlock may be more powerful but has its own security drawbacks.
Offline
#9 2019-05-28 23:31:20
- miomio
- Member
- Registered: 2016-01-17
- Posts: 167
Re: [Solved] Disable TTY when xsecurelock
Starting to sound like I should forget locking and just poweroff.
Offline
#10 2019-05-28 23:40:53
- Trilby
- Inspector Parrot
- Registered: 2011-11-29
- Posts: 30,530
- Website
Re: [Solved] Disable TTY when xsecurelock
If you have issues with running a setuid bit program you should be sure not to use sudo either.
Sudo is fine. Locking is fine.
"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman
Offline
#11 2019-05-29 12:21:55
- Nickolas0
- Member
- Registered: 2019-02-16
- Posts: 30
Re: [Solved] Disable TTY when xsecurelock
If you have issues with running a setuid bit program you should be sure not to use sudo either.
Sorry, but I'm not in all or nothing camp so don't even try to putting me there. By your logic any binary on system can be setuid because sudo is.
Sudo is fine. Locking is fine.
And setuid isn't and should be avoided wherever possible. Every program has its flaws and setuid ones are fatal. Those for sudo where hopefully fixed as it's under high scrutiny. It's hard to be sure about status of some random hobby project from github.
It would be nice to know why physlock capabilities are much higher than xsecurelock before recommending it to someone.
Offline
#12 2019-05-29 12:29:17
- Trilby
- Inspector Parrot
- Registered: 2011-11-29
- Posts: 30,530
- Website
Re: [Solved] Disable TTY when xsecurelock
Ah, no - I'm just saying if you are ok with using sudo, you are clearly ok with using a setuid program.
I recommended physlock as it is a direct answer to exactly what the OP asked for: a way to prevent someone from accessing other tty's while using an X screen locker.
Last edited by Trilby (2019-05-29 12:45:28)
"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman
Offline
Pages: 1