2

I recently purchased a U2F security key, and I have successfully configured my Ubuntu 18.04 machine to require authentication via the key as well as my usual password to log in. I am hoping to change my authentication configurations such that:

  1. When I first login to my machine, I need to both enter my password and insert my U2F key
  2. When I lock my already-logged-in machine, I need only to insert my U2F key to unlock it.

Is this something that is possible with the stock GNOME lock screen? If so, which pam configuration do I have to edit?

Currently the only thing I have changed is adding

auth    required  pam_u2f.so

to /etc/pam.d/gdm-password, under

@include common-auth
1

GNOME uses gdm-password as the PAM service name for both logins and unlocks, so it's not possible to distinguish them in PAM. To do so, you'd have to create a custom build of GNOME Shell, specifically editing js/gdm/util.js to use different service names depending on context. This would be a very useful feature to PR to them were you to do it.

  • Got it, that makes sense. Yeah I will look into that to determine if it's something that's within my capabilities. I rarely build linux utilities from source, though, so it may be beyond me. – Warmar Oct 7 '18 at 16:33
  • 1
    Created issue for this: gitlab.gnome.org/GNOME/gnome-shell/issues/1551 – Aaron Digulla Aug 28 at 9:30
0

A possible workaround is to use the pam_alreadyloggedin module. This is normally used to login without a password when you are already logged in on a different tty, but with some creative pam configuration, it can also be used to differentiate between the first login (not logged in yet) and unlocking or second logins (already logged in). The selection it makes is not perfect, but might be sufficient for your needs.

One big caveat is that the module does not recognize X sessions, only terminal sessions (because it checks ownership of the tty device, which X sessions do not have, so it ends up looking for /dev/:0 which does not exist). In practice, this means it will recognize you as logged in if you have any terminal open inside your X session (but also a screen or tmux running in the background).

I think something like the following could work for your usecase:

# Skip regular password checks when already logged in (i.e. also when
# unlocking). This skips a number of modules from common-auth when
# succesful, so this breaks when extra primary modules are added there,
# but this seems to be the only way (using success=done prevents
# optional post-auth modules from running).
auth [success=2 default=ok] pam_alreadyloggedin.so debug

@include common-auth

auth    required  pam_u2f.so

You might need to adapt this depending on what your common-auth file contains.

0

As a better (than pam_alreadyloggedin I suggested above) workaround, you can also use a custom script to check whether the current session is locked and change behaviour depending on that. For this, you can use the pam_script module. E.g. in your pam config, put something like:

# Skip regular password checks when there is a current session and it is
# locked. This skips a number of modules from common-auth when
# succesful, so this breaks when extra primary modules are added there,
# but this seems to be the only way (using success=done prevents
# optional post-auth modules from running).
auth [success=2 default=ok] pam_script.so dir=/etc/pam.d/is-current-session-locked     

@include common-auth

auth    required  pam_u2f.so

Then, create a script called /etc/pam.d/is-current-session-locked/pam_script_auth with the following contents and make it executable:

#!/bin/sh                                                                                               

if [ -z "$XDG_SESSION_ID" ]; then
        return 1                                                                                        
fi
if ! loginctl show-session "$XDG_SESSION_ID" | grep '^LockedHint=yes$' > /dev/null; then                
        return 1
fi

# Current session is locked, return success
return 0

This script checks to see if there is a login session id and then asks loginctl whether the session is locked. This does require the desktop environment to tell logind when it locks the desktop, but it seems that Gnome does this (at least on Ubuntu Disco).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.