pam_usb is a PAM module that enables either two-factor or password-less authentication using a USB storage device (such as a USB flash memory stick). It works with any application supporting PAM, such as su or any login manager (GDM, KDM), etc. The pam_usb package also contains pamusb-agent, a daemon that can trigger actions (such as locking the screen) upon device authentication and removal.
| Tags | Security Systems Administration |
|---|---|
| Licenses | GPL |
| Operating Systems | POSIX Linux |
| Implementation | C |
Recent releases


Release Notes: The code base was migrated to UDisks. pam_usb doesn't depend on HAL anymore.


Release Notes: Hardware support was improved. Now devices without vendor and model information can be used for authentication. Non-USB devices are now supported, so you can now use every kind of removable storage device, such as SD or MMC cards. Many other smaller bugfixes and features have been included, such as the DBUS workaround and support for Python 2.5.


Release Notes: A security issue related to OpenSSH authentication has been fixed. The quiet option has been fixed (now it is really quiet). Support has been added for devices without vendor/model information.


Release Notes: Both pam_usb and its tools (adm and hotplug) have been redesigned from the ground up and rewritten from scratch. Hardware recognition is now done through HAL, which provides a stable interface over kernel changes. Certificates have been replaced by one time pads. That will prevent copies of the USB device from being used for authentication. pam_usb now verifies device information (vendor, product, serial number, and UUID) in the authentication process. pamusb-agent (formely usbhotplug) make use of DBUS signals (sent by HAL) instead of kernel hotplugging.


Release Notes: This release adds a verbose mode that prints authentication status while the debug output is turned off. The code that checks whether the authentication is requested locally or remotely has been rewritten, and now works on systems that don't set PAM_TTY properly. There are better default options: on a common setup, you shouldn't need to set any option as the default suits most needs.