A computer is being used for shift work currently with a shared account with autologin at boot. Certain UI applications start up at autologin and its important that they run continuously.

How can we securely authenticate individual users into this system (such as with smartcard) without ever logging out? The individual users only unlock and lock the screen with their credentials, they don't own the account per se, and the account never logs out.

A suggested method is to connect the console to a KVM that supports authentication. This would require physical security of the system having that open console, and trust in the KVM. Clearly better than what we're doing now. Is there an elegant in-computer solution? It seems like a window manager ought to be configurable or modifiable to do such a thing. Maybe there are tutorials on this and I'm simply not using the right search terms?

  • Can you add an authentication layer to the applications themselves? – DopeGhoti Mar 1 '19 at 15:44
  • Thanks, but the goal is to authenticate operators who are using the computer, and not disturb (or have to modify) the applications which are left running 24/365 except for maintenance. It would be great if the applications were headless services and we could connect and disconnect freely with a stateless UI; but that's not the case. – MAXdB Mar 1 '19 at 23:11

You could try to implement smartcard-based authentication with PAM and map the smartcard certificate subject-DNs of all authorized users to this generic local login.

Newer versions of sssd have smartcard support. Not sure how mature it is though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.