3 ms·
Depends on the level of security you need. This would be enough for my personal laptop, where it's unlikely that I would be targeted by someone, even more so wi
by charles_f 5y ago
Depends on the level of security you need. This would be enough for my personal laptop, where it's unlikely that I would be targeted by someone, even more so with the skills and time to go and bypass the protection, all that to access my hn account and the half dozen code bases I work on that are already open source. My password manager locks itself whenever I lock the computer, and my webmail has a 1h session. It is much more likely that it would be captured as part of a robbery, or stolen in a cafe, and be resold on craigslist, in which case this level of security is probably sufficient.
My professional laptop could be different if I was working on something of any importance. That is not the case, but there the risk reward is different, and I would probably keep it to password + sec key or something in these lines
- myself248 5y agoI wish I could restrict it to NOT working everywhere PAM works. For instance, only face-unlock my screen if it locked for inactivity, and less than 15 minutes ago. If I manually locked it, require password. If I've been gone too long, require password. For sudo and bootup, always require password. That would make the level of (in)security acceptable to me. In its present state, I don't think it's appropriate.
- mminer237 5y agoYou can though: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-...
- lhl 5y agoI was gonna say well, of course you should be able to configure it within PAM to only be used for certain authentication types, but it turns out one of the literally five pages in the wiki covers just that: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-... And for anything PAM doesn't handle, since Howdy is just a Python lib/app, it's almost trivial to modify it to do anything else. You could just add your modifications into https://github.com/boltgolt/howdy/blob/beta/howdy/src/compare.py https://github.com/boltgolt/howdy/blob/beta/howdy/src/compar... (eg, make it autofail if a env/memory flag hasn't been set after first login, same with storing an inactivity flag, etc. Looks like the author is responsive taking pull requests, so you could even do it properly and get it upstreamed even: https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclosed https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclose... As for appropriateness, it's fine if it's not your cup of tea, but with 3.6K stars and 220 forks, obviously it works great/is useful for a lot of people so I'm glad that the author released and maintains it, even if it's not for everyone.
- myself248 5y agoWhoah. Okay, thank you, I had not found that page in a brief glance. Which admittedly was probably not enough of a glance to give it a fair shot. That's pretty awesome, I will have to poke at it. I also have fingerprint login so I'm sure I can get up to some silly hijinks...
- yrro 5y agoI think it would be interesting if logind was able to track such indications (locked because of inactivity, or due to smart card being removed, or because the system was moved outside of a geofence, or because Kerberos TGT expired), then a pam module could query logind in order to skip over pam_howdy.so based on the desired conditions. I've wanted that for some time with sssd (e.g., unlock with a single factor if my TGT is still valid) but never got around to filing the right RFEs.