3 ms·
I mean, that's pretty cool, but who enables password logins for SSH anymore? If I'm an attacker, I'm going to wonder why my target of duress is giving me a pass
by solatic 5y ago
I mean, that's pretty cool, but who enables password logins for SSH anymore? If I'm an attacker, I'm going to wonder why my target of duress is giving me a password and not a private key; most likely if I have access to my target of duress, then I have access to some kind of client / endpoint that my target uses to connect to the network, and that client will have the SSH private keys likely already loaded into ssh-agent.
Maybe a more modern concept would be to both a) have a duress private key, that triggers duress scripts in the same way, b) an implementation of ssh-agent that adds the duress private key when a duress password is entered?
- jstanley 5y agoI don't think this is specific to SSH. You could just as easily use this on your client machine and have it delete your private keys if you try to login with the duress password.
- tyingq 5y agoPam is for more than just ssh. This could wipe data on a Linux machine for a local login, gdm, sudo, and so on.
- taneliv 5y agoYes, and perhaps _not_ use pam_duress for remote logins, in case you want to keep your duress password simple (think "password" or something similar, actually memorable in a duress situation).
- wowaname 5y agoI use an authentication PGP subkey for SSH so I have to unlock it with a passphrase before using it. Normal SSH keys can be encrypted similarly, and either gpg-agent or ssh-agent can save your passphrase in memory for an amount of time.