1

After installing Kali with the Nuke feature I'm wondering if there's an easy way to limit failed login attempts by simply erasing the LUKS keys-lots.

EDIT: I'm asking with the idea in mind to store the password - with some random strings inside and besides it or in some other creative way - in front of the computer monitor.

1 Answer 1

1

The information necessary to log in is stored in /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. Killing a LUKS slot won't do anything to those files.

There's no way to get a portion of those files (i.e. the password hashes) relating to a single user information to live on a LUKS partition. You can't split up /etc/shadow where each user-specific line is on a separate partition.

But ...

  • If each user had their home directory on a LUKS partition
  • provisions were made to create such partitions when adding a user
  • provisions were made to acquire a password or key file upon login (unless you really want to use the user's password as the LUKS password - may not be the best idea)
  • provisions were made to kill the LUKS slot upon so many failed logins (probably possible with PAM)

then it could be somewhat useful. This isn't the default on any Linux distribution I know of but certainly possible to set up with a lot of work. I'm unaware of a project that does this.

Having destruction of a LUKS partition result in a user's inability to log in is difficult unless the login password is the same as the LUKS partition password. PAM allows the Linux authentication system to be extended in practically any crazy way you want. Maybe logging in by key-file on USB would be better - buit that presents issues of its own (root can see the volume when mounted, etc.)

So it's completely possible to do this or anything you want relating to authentication schemes really, just that I don't know of any project that has done it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.