PAM USB Authentication

Ill touch on pamusb configuration here real quick, cause this one is cool AF. I love the idea of having a little token/key that you authenticate with. The desired end goal of ALL of these articles uses such a device not just to auth the user but to also decrypt the root partition. However this article just outlines userauth.

The currently active repository is here. https://github.com/mcdope/pam_usb

From the installation guide in the github “There is an APT repository with prebuilt deb packages available. You can find it at https://apt.mcdope.org/.”

This is the process for a Debian based system. Arch has a robust article for it’s own system that I used to use. https://wiki.archlinux.org/title/Pam_usb

configure the APT repository.

Import the GPG key:

sudo gpg --no-default-keyring \
--keyring /usr/share/keyrings/apt.mcdope.org.gpg \
--keyserver keyserver.ubuntu.com \
--recv-keys 913558C8A5E552A7

add the following line to /etc/apt/sources.list

deb [signed-by=/usr/share/keyrings/apt.mcdope.org.gpg]\
https://apt.mcdope.org/ ./

run:

sudo apt install pam libpam-usb

USB Configuration

These are the steps written here. https://github.com/mcdope/pam_usb/wiki/Getting-Started#setting-up-devices-and-users

You will first add a device with

pamusb-conf --add-device <MY DEVICE NAME>

Then configure that device with a user:

pamusb-conf --add-user <MY USERNAME>

Then check it with:

pamusb-check <MY USERNAME>

PAM Configuration

This SHOULD have done the following for you but let’s check anyway.

In /etc/pam.d/common-auth check for the following configuration lines

auth	sufficient	pam_usb.so 
auth	[success=1 default=ignore]	pam_unix.so nullok try_first_pass

The line containing pam_unix.so is the default and above it has been added the line containing pam_usb.so If this is not visible, please add it.

you MAY have to reboot to get this to take effect.

---