Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #235184 > unrolled thread

Signed Email PAM authentication

Back to article view | Back to linux.debian.user

Contents

  Signed Email PAM authentication Marek Mosiewicz <marek.mosiewicz@jotel.com.pl> - 2021-05-14 16:40 +0200
    Re: Signed Email PAM authentication Darac Marjal <mailinglist@darac.org.uk> - 2021-05-14 17:10 +0200
      Re: Signed Email PAM authentication Marek Mosiewicz <marek.mosiewicz@jotel.com.pl> - 2021-05-14 19:50 +0200
    Re: Signed Email PAM authentication Celejar <celejar@gmail.com> - 2021-05-14 17:20 +0200
    Re: Signed Email PAM authentication David Wright <deblis@lionunicorn.co.uk> - 2021-05-14 18:00 +0200
      Re: Signed Email PAM authentication Marek Mosiewicz <marek.mosiewicz@jotel.com.pl> - 2021-05-14 19:30 +0200

#235184 — Signed Email PAM authentication

Hello,

I think of idea of having additional PAM module which passes login
after receiving and validating signed email (for some scenarios it
could even requires emails from many persons). Signing emails can be
done easliy in secure way and it could be also good for auditing.

Cheers,
    Marek Mosiewicz

[toc] | [next] | [standalone]

#235186

[Multipart message — attachments visible in raw view] — view raw

On 14/05/2021 15:29, Marek Mosiewicz wrote:
> Hello,
>
> I think of idea of having additional PAM module which passes login
> after receiving and validating signed email (for some scenarios it
> could even requires emails from many persons). Signing emails can be
> done easliy in secure way and it could be also good for auditing.

My first thought was "Doesn't PAM have some sort of timeout?" but it
looks like it doesn't. If you have users who can bear to potentially
wait a matter of days before knowing whether they're permitted to access
a system, then I guess this could work. It sounds a little
Heath-Robinson, but  maybe you can argue the case for an ultra-secure
host where every login must come to the immediate attention of one or
more humans.

Hmm. Thinking about it a little more, you might need to consider some
points about reliability:

* If PAM sends an email, it can REQUEST delivery and read receipts, but
those are optional features of email. There's no guarantee that the
email will arrive at the destination.

* Similarly, PAM has no way to guarantee that the signer's reply will
arrive. 

Now, you might be able to say "Well, we use  GMail/HotMail/NeverFails
which is 100% online" or "We always send to X signers and need a quorum
of at least Y of them - which handles the situation when Kevin is on
holiday in the Bahamas for three weeks", but you might want to at least
CONSIDER sending follow up emails (not too often, though. One or two
days between them perhaps?) so that you don't end up waiting for a reply
that will never come.

>
> Cheers,
>     Marek Mosiewicz
>

[toc] | [prev] | [next] | [standalone]

#235195

W dniu pią, 14.05.2021 o godzinie 16∶05 +0100, użytkownik Darac Marjal
napisał:
> 
> On 14/05/2021 15:29, Marek Mosiewicz wrote:
> > Hello,
> > 
> > I think of idea of having additional PAM module which passes login
> > after receiving and validating signed email (for some scenarios it
> > could even requires emails from many persons). Signing emails can
> > be
> > done easliy in secure way and it could be also good for auditing.
> 
> My first thought was "Doesn't PAM have some sort of timeout?" but it
> looks like it doesn't. If you have users who can bear to potentially
> wait a matter of days before knowing whether they're permitted to
> access
> a system, then I guess this could work. It sounds a little
> Heath-Robinson, but  maybe you can argue the case for an ultra-secure
> host where every login must come to the immediate attention of one or
> more humans.
It is already used in some places that you need to commit your login
via app like PingOn. This method however just makes http answer and
authorizes you via fingerprint. Signed content would be better.
If you trust your bot it could also instruct it to send email
> 
> Hmm. Thinking about it a little more, you might need to consider some
> points about reliability:
> 
Signing email from you email client is easy. Alternatiely you can write
some script which will just put signed email in server local box which
is I thing good enough delivery channel or at least you know if it
happens
> * If PAM sends an email, it can REQUEST delivery and read receipts, but
> those are optional features of email. There's no guarantee that the
> email will arrive at the destination.
> 
> * Similarly, PAM has no way to guarantee that the signer's reply will
> arrive. 
> 
> Now, you might be able to say "Well, we use  GMail/HotMail/NeverFails
> which is 100% online" or "We always send to X signers and need a
> quorum
> of at least Y of them - which handles the situation when Kevin is on
> holiday in the Bahamas for three weeks", but you might want to at
> least
> CONSIDER sending follow up emails (not too often, though. One or two
> days between them perhaps?) so that you don't end up waiting for a
> reply
> that will never come.
> 
That is possibly rare scenario, but some people could appreciate it
that there is no mess if somebody login to bank server. It could be
also good if somebody else knows that someone else logged in.
> > 
> > Cheers,
> >     Marek Mosiewicz
> > 
> 

[toc] | [prev] | [next] | [standalone]

#235188

On Fri, 14 May 2021 16:29:32 +0200
Marek Mosiewicz <marek.mosiewicz@jotel.com.pl> wrote:

> Hello,
> 
> I think of idea of having additional PAM module which passes login
> after receiving and validating signed email (for some scenarios it
> could even requires emails from many persons). Signing emails can be
> done easliy in secure way and it could be also good for auditing.

About 10-15 years ago, largely as a coding exercise / proof of concept,
I wrote "mailmin", a Perl program that allows access to a remote system
via signed / encrypted email. I am not a security expert or even
a very skilled hobbyist, so it's strictly amateur-hour stuff, and
undoubtedly horribly insecure, and in any event, it doesn't use the PAM
framework, so I doubt it'll be of much use to you, but it was a
somewhat similar idea ...

https://sourceforge.net/projects/mailmin/

Celejar

[toc] | [prev] | [next] | [standalone]

#235191

On Fri 14 May 2021 at 16:29:32 (+0200), Marek Mosiewicz wrote:
> 
> I think of idea of having additional PAM module which passes login
> after receiving and validating signed email (for some scenarios it
> could even requires emails from many persons).

That's all very vague. You need to specify a sequence of
who has to do what, where, and how.

After that, you have the problem of how/where you suspend
this process until all^H^H^H the replies are received.
(BTW I would suggest a quorum.)
Normally, a successful login is fast; it's those that fail
which take more time.

> Signing emails can be
> done easliy in secure way

That's a separate issue.

> and it could be also good for auditing.

How?

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#235194

W dniu pią, 14.05.2021 o godzinie 10∶52 -0500, użytkownik David Wright
napisał:
> On Fri 14 May 2021 at 16:29:32 (+0200), Marek Mosiewicz wrote:
> > 
> > I think of idea of having additional PAM module which passes login
> > after receiving and validating signed email (for some scenarios it
> > could even requires emails from many persons).
> 
> That's all very vague. You need to specify a sequence of
> who has to do what, where, and how.
> 
> After that, you have the problem of how/where you suspend
> this process until all^H^H^H the replies are received.
> (BTW I would suggest a quorum.)
> Normally, a successful login is fast; it's those that fail
> which take more time.
> 
> > Signing emails can be
> > done easliy in secure way
> 
> That's a separate issue.
> 
> > and it could be also good for auditing.
> 
> How?
If we have private key on crypto device we know that either admin gave
access or there is some physical interruption to admin office. It could
be done also by ssh key stored on crypto device, but email (possibly
auto forwarded somewhere)is proof that access has been really granted
which is not case for ssh where access logs can be altered.
> 
> Cheers,
> David.
> 

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web