4

A computer is being used for shift work currently with a shared account with autologin at boot. Certain UI applications start up at autologin and its important that they run continuously.

How can we securely authenticate individual users into this system (such as with smartcard) without ever logging out? The individual users only unlock and lock the screen with their credentials, they don't own the account per se, and the account never logs out.

A suggested method is to connect the console to a KVM that supports authentication. This would require physical security of the system having that open console, and trust in the KVM. Clearly better than what we're doing now. Is there an elegant in-computer solution? It seems like a window manager ought to be configurable or modifiable to do such a thing. Maybe there are tutorials on this and I'm simply not using the right search terms?

2
  • Can you add an authentication layer to the applications themselves?
    – DopeGhoti
    Mar 1, 2019 at 15:44
  • Thanks, but the goal is to authenticate operators who are using the computer, and not disturb (or have to modify) the applications which are left running 24/365 except for maintenance. It would be great if the applications were headless services and we could connect and disconnect freely with a stateless UI; but that's not the case.
    – MAXdB
    Mar 1, 2019 at 23:11

1 Answer 1

1

You could try to implement smartcard-based authentication with PAM and map the smartcard certificate subject-DNs of all authorized users to this generic local login.

Newer versions of sssd have smartcard support. Not sure how mature it is though.

1
  • This is really good. I'm going to pass it onto our IT people. PS, yes nothing has been done in the last year, we are still using a shared account, but pressure steadily increaes to cease doing that. A shared account with discrete smartcard logins seems great. Just lock screen, and unlock with different card and PIN..
    – MAXdB
    Apr 13, 2020 at 4:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.