Date: Wed, 8 Sep 2010 14:45:43 +0300 From: Gleb Kurtsou <gleb.kurtsou@gmail.com> To: Daniel O'Connor <doconnor@gsoft.com.au> Cc: freebsd-current@freebsd.org, Thomas Vogt <thomas@bsdunix.ch> Subject: Re: pam_pefs setup (Re: RFC: pefs - stacked cryptographic filesystem) Message-ID: <20100908114543.GA2312@tops> In-Reply-To: <ABE5C83C-DB88-4A13-A765-22046FB64B2E@gsoft.com.au> References: <20100906183838.GA3460@tops> <20100906230322.GA5457@tops> <4C86246B.9020802@bsdunix.ch> <20100907135326.GA1712@tops> <4C864D18.2010504@bsdunix.ch> <20100907175207.GB1793@tops> <ABE5C83C-DB88-4A13-A765-22046FB64B2E@gsoft.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On (08/09/2010 11:25), Daniel O'Connor wrote: > > On 08/09/2010, at 3:22, Gleb Kurtsou wrote: > > Please note that your home directory has to be mounted, I mount it in > > /etc/rc.local, but don't add any keys. pam_pefs adds the key. Also note > > that it has to be exactly your home directory (/home/gleb in my case), to > > prevent possible attacks. And keychain database has to be created, so > > that pam_pefs knows how to verify the key. > > Have you considered something similar to pam_mount? (http://pam-mount.sourceforge.net/) > > ie pam_pefs could mount your home directory itself and unmount it on logout. I knew about pam_mount before starting pam_pefs and my intent was to keep pam_pefs as simple as possible. Unlike some other stacked cryptographic filesystems, pefs can be mounted in read-only mode without providing a key. pam_mount can be used together with pam_pefs to mount/unmount filesystem on login/logout if needed. pam_mount is more generic then pam_pefs. At the moment pam_pefs doesn't remove key on logout because it is a bit tricky if there are several keys installed. I'm also against the idea of keeping keys installed by current session during the session to remove them on logout. Key chains for different sessions may overlap. I'd suggest to use pam_mount to unmount filesystem on logout in such scenario. Thanks, Gleb. > -- > Daniel O'Connor software and network engineer > for Genesis Software - http://www.gsoft.com.au > "The nice thing about standards is that there > are so many of them to choose from." > -- Andrew Tanenbaum > GPG Fingerprint - 5596 B766 97C0 0E94 4347 295E E593 DC20 7B3F CE8C
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100908114543.GA2312>