pam usb is secure?

[arara]

I am trying pam-usb (www.pamusb.org), it seems to work fine to me.
I like to know if this tool is strong enough to be used in a professional workstation or if it is only for amateurs.
I am not talking about problems like the risk to lost the USB device or if someone clone the USB device, but if the program itself is valid and strong.

Also I'd like to know why it is not in the Fedora repository? It is because it is not considered usefull or because it didn't pass some quality test?

[SlowJet]

The documentation does not cover the pad bits enough to dertemine how secure those are.
It says the pad is regened after successful auth but then has a default of hr regeneration?
Does it let you logon more than on time per session?
Form Gnome, a terminal, from a console - it the pad usable and regened each time.

If your system was cracked by username and a simple (no password) attempt, it seems like the pan-usb would auth and (especially, root name would not be a guess (I see no way to stop a cracker from just using root).

It doesn't say anything about the tcp packet being encoded at all or whatever protocol it is using (and how does another machine fine the local usb device?)

Pam can check many parameters but I don't see any of these advanced parms in the config file info.
And even so, a local pam auth as Fedora does it is from the system protected area of the /etc.

I would not trust it without knowing more about the pad gen and transmission method.
However it is very convenient and if it were secure could eliminate a ldap and/or a w2k3 server?

just my 2, no reply needed,

SJ

[arara]

Thanks for yours reply, you had seen some things that I didn't notice.

The documentation does not cover the pad bits enough to dertemine how secure those are.
It says the pad is regened after successful auth but then has a default of hr regeneration?

The pad is generated randomly in this way:
srand(getpid() * time(NULL));
for (i = 0; i < sizeof(magic); ++i)
magic[i] = (char)rand();

This is not strong enough imho, because if I see when the user login and when he logout I can calculate the time when the last Pad was generated, and if I know the uid of that user I have enough info to try to generate a new valid Pad and to access to his account.
This normally is not a real problem because pam_usb check the USB vendor, model and serial number in addition to the Pad.
But if the device doesn't have the serial id and I have a device with the same vendor and model, I can use the pad that I cracked to login in his account.
A more robust Pad regeneration algorithm should be added.

It says the pad is regened after successful auth but then has a default of hour regeneration?
Does it let you logon more than on time per session?
Form Gnome, a terminal, from a console - it the pad usable and regened each time.

Yes, I can login more than time per session, so the pad is regenerated each time. But this shouldn't be a problem imho.

Pam can check many parameters but I don't see any of these advanced parms in the config file info.

I don't know, I'll watch better about this.

If your system was cracked by username and a simple (no password) attempt, it seems like the pan-usb would auth and (especially, root name would not be a guess (I see no way to stop a cracker from just using root).
It doesn't say anything about the tcp packet being encoded at all or whatever protocol it is using (and how does another machine fine the local usb device?)
[...]
I would not trust it without knowing more about the pad gen and transmission method.
However it is very convenient and if it were secure could eliminate a ldap and/or a w2k3 server?

Of course pam_usb cannot replace ldap, but this is not his intent.
pam_usb was made to be used in single PC, it doesn't have a network oriented structure.

Imho pam_usb is secure if the USB device has a vendor, model and serial id and the USB device is used only for the authentication and is not plugged in other PC.
Such as a password, the user had to kept the USB device only for him. If someone can acces to it, the security may be compromised.

Until I use my USB device only to authenticate on my own PC and no other people use it, I think it should be safe for a normal use, like a small office.

However before use it really I want watch better the code and make some test, probably he need some hacks.