Re: Signed Email PAM authentication

From	Marek Mosiewicz <marek.mosiewicz@jotel.com.pl>
Newsgroups	linux.debian.user
Subject	Re: Signed Email PAM authentication
Date	2021-05-14 19:30 +0200
Message-ID	<CeJNn-2F2-1@gated-at.bofh.it> (permalink)
References	<CeH8S-14A-1@gated-at.bofh.it> <CeIoi-1IQ-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

W dniu pią, 14.05.2021 o godzinie 10∶52 -0500, użytkownik David Wright
napisał:
> On Fri 14 May 2021 at 16:29:32 (+0200), Marek Mosiewicz wrote:
> > 
> > I think of idea of having additional PAM module which passes login
> > after receiving and validating signed email (for some scenarios it
> > could even requires emails from many persons).
> 
> That's all very vague. You need to specify a sequence of
> who has to do what, where, and how.
> 
> After that, you have the problem of how/where you suspend
> this process until all^H^H^H the replies are received.
> (BTW I would suggest a quorum.)
> Normally, a successful login is fast; it's those that fail
> which take more time.
> 
> > Signing emails can be
> > done easliy in secure way
> 
> That's a separate issue.
> 
> > and it could be also good for auditing.
> 
> How?
If we have private key on crypto device we know that either admin gave
access or there is some physical interruption to admin office. It could
be done also by ssh key stored on crypto device, but email (possibly
auto forwarded somewhere)is proof that access has been really granted
which is not case for ssh where access logs can be altered.
> 
> Cheers,
> David.
>

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Signed Email PAM authentication Marek Mosiewicz <marek.mosiewicz@jotel.com.pl> - 2021-05-14 16:40 +0200
  Re: Signed Email PAM authentication Darac Marjal <mailinglist@darac.org.uk> - 2021-05-14 17:10 +0200
    Re: Signed Email PAM authentication Marek Mosiewicz <marek.mosiewicz@jotel.com.pl> - 2021-05-14 19:50 +0200
  Re: Signed Email PAM authentication Celejar <celejar@gmail.com> - 2021-05-14 17:20 +0200
  Re: Signed Email PAM authentication David Wright <deblis@lionunicorn.co.uk> - 2021-05-14 18:00 +0200
    Re: Signed Email PAM authentication Marek Mosiewicz <marek.mosiewicz@jotel.com.pl> - 2021-05-14 19:30 +0200

csiph-web