search

nuvious / pam-duress

A Pluggable Authentication Module (PAM) which allows the establishment of alternate passwords that can be used to perform actions to clear sensitive data, notify IT/Security staff, close off sensitive network connections, etc if a user is coerced into giving a threat actor a password.
GNU Lesser General Public License v3.0
1.34k stars 40 forks source link

Add macOS support #6

Closed cormacrelf closed 3 years ago

cormacrelf commented 3 years ago

Fixes #5

As noted there, there is a bug where you can get a SIGSEGV when using this with sudo and hitting Ctrl-C. I don't know if this is macOS specific.

Needs documentation but basically add this to some /etc/pam.d file.

# sudo: auth account password session
auth       sufficient     pam_smartcard.so
auth       required       pam_opendirectory.so
# add this line here
auth       optional       pam_duress.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

The installer will copy the PAM module to /usr/local/lib/pam because /usr/lib/pam is not writable even with sudo with SIP enabled. I think that's what's happening anyway.

Includes a couple of incidental changes which I think are appropriate anyway:

cormacrelf commented 3 years ago

It does fix it, yes.

pam-duress on  main took 1m2s ❯ sudo pam_test cormac
Password:
hello from duress, who am i? cormac

I will PR a make install fix for what happens when you overwrite the pam module without deleting it first. (Apple considers the binary has been modified and it fails code signature validation. This is a bit dumb but yeah. Classic problem and can really get in the way if it blocks you from using sudo! If anybody messes this up, reboot in single user mode and remove any offending lines from the pam.d files. If you can fix it without doing that, the permissions on the .so are not constrained enough.)