4 ms·

I wish I could restrict it to NOT working everywhere PAM works. For instance, only face-unlock my screen if it locked for inactivity, and less than 15 minutes

I wish I could restrict it to NOT working everywhere PAM works. For instance, only face-unlock my screen if it locked for inactivity, and less than 15 minutes ago. If I manually locked it, require password. If I've been gone too long, require password. For sudo and bootup, always require password. That would make the level of (in)security acceptable to me. In its present state, I don't think it's appropriate.

mminer237 5y ago
You can though: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-...
lhl 5y ago
I was gonna say well, of course you should be able to configure it within PAM to only be used for certain authentication types, but it turns out one of the literally five pages in the wiki covers just that: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-... And for anything PAM doesn't handle, since Howdy is just a Python lib/app, it's almost trivial to modify it to do anything else. You could just add your modifications into https://github.com/boltgolt/howdy/blob/beta/howdy/src/compare.py https://github.com/boltgolt/howdy/blob/beta/howdy/src/compar... (eg, make it autofail if a env/memory flag hasn't been set after first login, same with storing an inactivity flag, etc. Looks like the author is responsive taking pull requests, so you could even do it properly and get it upstreamed even: https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclosed https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclose... As for appropriateness, it's fine if it's not your cup of tea, but with 3.6K stars and 220 forks, obviously it works great/is useful for a lot of people so I'm glad that the author released and maintains it, even if it's not for everyone.
- myself248 5y ago
  Whoah. Okay, thank you, I had not found that page in a brief glance. Which admittedly was probably not enough of a glance to give it a fair shot. That's pretty awesome, I will have to poke at it. I also have fingerprint login so I'm sure I can get up to some silly hijinks...
yrro 5y ago
I think it would be interesting if logind was able to track such indications (locked because of inactivity, or due to smart card being removed, or because the system was moved outside of a geofence, or because Kerberos TGT expired), then a pam module could query logind in order to skip over pam_howdy.so based on the desired conditions. I've wanted that for some time with sssd (e.g., unlock with a single factor if my TGT is still valid) but never got around to filing the right RFEs.

mminer237 5y ago

You can though: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-...

lhl 5y ago

I was gonna say well, of course you should be able to configure it within PAM to only be used for certain authentication types, but it turns out one of the literally five pages in the wiki covers just that: https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-specific-authentication-types https://github.com/boltgolt/howdy/wiki/Only-using-howdy-for-... And for anything PAM doesn't handle, since Howdy is just a Python lib/app, it's almost trivial to modify it to do anything else. You could just add your modifications into https://github.com/boltgolt/howdy/blob/beta/howdy/src/compare.py https://github.com/boltgolt/howdy/blob/beta/howdy/src/compar... (eg, make it autofail if a env/memory flag hasn't been set after first login, same with storing an inactivity flag, etc. Looks like the author is responsive taking pull requests, so you could even do it properly and get it upstreamed even: https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclosed https://github.com/boltgolt/howdy/pulls?q=is%3Apr+is%3Aclose... As for appropriateness, it's fine if it's not your cup of tea, but with 3.6K stars and 220 forks, obviously it works great/is useful for a lot of people so I'm glad that the author released and maintains it, even if it's not for everyone.

myself248 5y ago
Whoah. Okay, thank you, I had not found that page in a brief glance. Which admittedly was probably not enough of a glance to give it a fair shot. That's pretty awesome, I will have to poke at it. I also have fingerprint login so I'm sure I can get up to some silly hijinks...

yrro 5y ago

I think it would be interesting if logind was able to track such indications (locked because of inactivity, or due to smart card being removed, or because the system was moved outside of a geofence, or because Kerberos TGT expired), then a pam module could query logind in order to skip over pam_howdy.so based on the desired conditions. I've wanted that for some time with sssd (e.g., unlock with a single factor if my TGT is still valid) but never got around to filing the right RFEs.