I am trying to improve the Security of my overall IT Infrastructure, so I started out to use a smart card for login. I have managed to configure a PIV Smart Card with a private key and a x.509 certificate and setup
pam_pkcs#11 such that the Smart Card login works. As described in the docs, I have add this:
auth [success=2 default=ignore] pam_pkcs11.so
etc/pam.d/common-auth and since than the smartcard login works. But now, if the reader and the smartcard is removed, the system falls back to a password login (gnome in the case).
So my goal is to completely disable password login, no matter if there is a graphical interface or not. If the reader and the smartcard is not connected, login should not be possible.
Somewhere I have read that
passwd -l $(whoami) will set the password for a certain account inactive, but that doesn't feel right to me.
Is it possible to do that with
pam, such that password login is disabled for the whole machine?
btw: right now I am using ubuntu 19.10