1

I'm using Pop!_OS (essentially ubuntu + tweaks with a gnome environment) and I've recently acquired a Mooltipass hardware password manager.

This tool has the capability to manage SSH keys.

I was wondering if it is possible and, if so, how, one might go about disabling password access to a desktop environment and using key-based authentication (SSH style) to log in instead?

1

The closest thing to what you are trying to do is:

  • Install pamusb-tools and libpam-usb.
  • Setup pamusb to use your mooltipass
    lsusb to find your device id
    sudo panusb-conf --add-device usb-name
    sudo panusb-conf --add-user username
    sudo nano /etc/pam.d/common-auth

  • change the two lines after the #Here are the per-package modules, to read:
    auth sufficient pam_usb.so
    auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass

  • Then setup your other programs, to use the credentials on the mooltipass device.

This will allow login with the mooltipass and also keep your other passwords handy.

Reference: Here and Here

The reason I think this is good enough is because if the person has your usb key they have it, regaurdless of if it is a crypto key or the uuid/name and serial number of the device it's self. The caveat comes from it not using the pin-code to unlock the device and then the computer. However if there is a device section that is available when the mooltipass is unlocked vs locked, you could just add the device that is available when mooltipass is unlocked and then your gold.

0

You need to edit /etc/ssh/sshd_config. It is all in the manual. On Debian there are a load of comments in there, so you may be able to wing it.

First test that key based authentication is working, then disable password authentication, and test it is disabled (you may have to restart sshd).

  • I think the OP is asking about using SSH keys to login as a regular Desktop user... – RubberStamp Jan 4 at 19:11
  • @RubberStamp yes that was my assumption, when I wrote the question. Do you think there is an error? – ctrl-alt-delor Jan 5 at 13:30
  • Some re-configuration of pam is necessary to enable key based login via a local user through the display manager, such as gdm .... – RubberStamp Jan 5 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.