File	Date	Author	Commit
AUTHORS	2019-01-14	Jerome Benoit	[122e7a] remove leftovers from dropped support of SSH1
COPYING	2004-02-19	akorty	[3c2889] Update copyright information.
ChangeLog	2019-01-14	Wolfgang Rosenauer	[6b4848] release 2.3
INSTALL	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
Makefile.am	2019-01-08	Phil Sutter	[1c0e35] Drop SSH1 support
Makefile.in	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
NEWS	2019-01-14	Wolfgang Rosenauer	[6b4848] release 2.3
README	2019-01-14	Jerome Benoit	[122e7a] remove leftovers from dropped support of SSH1
TODO	2002-08-09	akorty	[fd28bf] Updated.
acinclude.m4	2013-11-10	Jerome Benoit	[f78310] fixes for the autotools machinery
aclocal.m4	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
atomicio.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
atomicio.h	2013-11-10	Jerome Benoit	[84c6eb] update openssh embedded code
authfd.c	2019-01-08	Phil Sutter	[325321] Drop RSA1 support
authfd.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
authfile.c	2019-01-08	Phil Sutter	[1c0e35] Drop SSH1 support
authfile.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
base64.c	2015-05-03	Jerome Benoit	[02eea2] render the functions `b64_ntop' and `b64_pton' ...
base64.h	2015-05-03	Jerome Benoit	[02eea2] render the functions `b64_ntop' and `b64_pton' ...
bcrypt_pbkdf.c	2015-05-03	Jerome Benoit	[12512e] Fix warnings emitted by gcc against the OpenSSH...
blf.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
blocks.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
blowfish.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
bootstrap.sh	2013-11-13	Wolfgang Rosenauer	[1df5d9] remove old automake requirement since newer ver...
bufaux.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
bufbn.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
bufec.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
buffer.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
buffer.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
chacha.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
chacha.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
cipher-aesctr.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
cipher-chachapoly.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
cipher-chachapoly.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
cipher-ctr.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
cipher.c	2019-01-08	Phil Sutter	[1c0e35] Drop SSH1 support
cipher.h	2019-01-08	Phil Sutter	[5c5e38] Port to OpenSSL-1.1.0
cleanup.c	2013-11-10	Wolfgang Rosenauer	[a85a89] add new files from openssh update
compile	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
config.guess	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
config.h.in	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
config.sub	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
configure	2019-01-14	Wolfgang Rosenauer	[6b4848] release 2.3
configure.ac	2019-01-14	Wolfgang Rosenauer	[6b4848] release 2.3
crypto_api.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
defines.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
depcomp	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
digest-openssl.c	2019-01-08	Phil Sutter	[5c5e38] Port to OpenSSL-1.1.0
digest.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
ed25519.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
explicit_bzero.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
fatal.c	2013-11-10	Wolfgang Rosenauer	[a85a89] add new files from openssh update
fe25519.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
fe25519.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
ge25519.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
ge25519.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
ge25519_base.data	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
hash.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
includes.h	2015-05-03	Jerome Benoit	[02eea2] render the functions `b64_ntop' and `b64_pton' ...
install-sh	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
kex.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
key.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
key.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
log.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
log.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
ltmain.sh	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
misc.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
misc.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
missing	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
mkinstalldirs	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
openpam_borrow_cred.c	2008-05-12	Wolfgang Rosenauer	[dd6d39] Merged back the changes of the branch maintaine...
openpam_cred.h	2002-09-23	akorty	[4b1137] More portability stuff.
openpam_restore_cred.c	2008-05-12	Wolfgang Rosenauer	[dd6d39] Merged back the changes of the branch maintaine...
openssl_compat.h	2019-01-08	Phil Sutter	[5c5e38] Port to OpenSSL-1.1.0
pam.conf.example	2004-02-19	akorty	[631594] Example pam.conf file
pam_get_pass.c	2013-11-10	Jens Peter Secher	[2db072] try_first_password implementation and specific ...
pam_get_pass.h	2013-11-10	Jens Peter Secher	[2db072] try_first_password implementation and specific ...
pam_option.h	2002-09-20	akorty	[52ad78] Mac OS X support: detect PAM options type and s...
pam_opttab.h	2002-09-20	akorty	[52ad78] Mac OS X support: detect PAM options type and s...
pam_ssh.8	2019-01-14	Jerome Benoit	[df38af] Correct spelling typo in the manpage
pam_ssh.c	2019-01-14	Jerome Benoit	[122e7a] remove leftovers from dropped support of SSH1
pam_ssh.spec	2019-01-09	Wolfgang Rosenauer	[fa0669] refresh automake/autoconf and mark version 2.2
pam_ssh_log.c	2008-05-12	Wolfgang Rosenauer	[dd6d39] Merged back the changes of the branch maintaine...
pam_ssh_log.h	2008-05-12	Wolfgang Rosenauer	[dd6d39] Merged back the changes of the branch maintaine...
pam_std_option.c	2008-05-12	Wolfgang Rosenauer	[dd6d39] Merged back the changes of the branch maintaine...
pam_test.c	2004-02-20	akorty	[2ea6f3] Test dlopening pam_ssh.so and print any resulti...
poly1305.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
poly1305.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
rijndael.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
rijndael.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
rsa.c	2019-01-08	Phil Sutter	[5c5e38] Port to OpenSSL-1.1.0
rsa.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
sc25519.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
sc25519.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
ssh-dss.c	2019-01-08	Phil Sutter	[5c5e38] Port to OpenSSL-1.1.0
ssh-ecdsa.c	2019-01-08	Phil Sutter	[5c5e38] Port to OpenSSL-1.1.0
ssh-ed25519.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
ssh-rsa.c	2019-01-08	Phil Sutter	[5c5e38] Port to OpenSSL-1.1.0
ssh.h	2019-01-08	Phil Sutter	[325321] Drop RSA1 support
ssh2.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
sshbuf-getput-basic.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
sshbuf-getput-crypto.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
sshbuf-misc.c	2015-05-03	Jerome Benoit	[02eea2] render the functions `b64_ntop' and `b64_pton' ...
sshbuf.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
sshbuf.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
ssherr.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
ssherr.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
sshkey.c	2019-01-08	Phil Sutter	[325321] Drop RSA1 support
sshkey.h	2019-01-08	Phil Sutter	[325321] Drop RSA1 support
strlcpy.c	2002-04-07	akorty	[c52f4a] Provided for systems which lack these facilities.
strlcpy.h	2002-09-23	akorty	[060ec3] strlcpy() declaration for platforms that don't ...
strnvis.c	2004-02-20	akorty	[b8143b] Include <sys/types.h> and <limits.h> in various...
strnvis.h	2004-02-20	akorty	[785d77] Use strnvis.c and strnvis.h to match function n...
timingsafe_bcmp.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
verify.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
xmalloc.c	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code
xmalloc.h	2015-05-03	Jerome Benoit	[8e1594] update openssh embedded code

Read Me

This PAM module provides single sign-on behavior for SSH.  The user
types an SSH passphrase when logging in (probably to GDM, KDM, or XDM)
and is authenticated if the passphrase successfully decrypts the
user's SSH private key.  In the PAM session phase, an ssh-agent
process is started and keys are added.  For the entire session, the
user can SSH to other hosts that accept key authentication without
typing any passwords.

http://sourceforge.net/projects/pam-ssh/


Per-user setup
--------------

pam_ssh will try to decrypt the traditional SSH keys, that is, files
matching $HOME/.ssh/id(entity|_(r|d|ecd)sa).  pam_ssh will also try to
decrypt all keys in the directories $HOME/.ssh/login-keys.d and
$HOME/.ssh/session-keys.d, and (if your system administrator has
configured your system thus) allow you to log in using any of these login
keys. So if you want to log in by using an SSH key passphrase, you should
create a login-keys.d directory and in this directory create (symbolic
links to) all the keys you want to use as login keys. Nevertheless keys
in the directory $HOME/.ssh/login-keys.d with .disabled or .frozen as
suffix are ignored. The handling for keys in $HOME/.ssh/session-keys.d
is similar bot those are not used for login purposes.

All SSH keys that are successfully decrypted will be added to the
ssh-agent.


System-wide setup
-----------------

As system administrator you have to add a line to the PAM script for
each service where you want to use pam_ssh.  For example, to add
pam_ssh to /etc/pam.d/login as a single-sign-on method, change

  ...
  @include common-auth
  ...
  @include common-session
  ...

to

  ...
  @include common-auth
  auth optional pam_ssh.so use_first_pass
  ...
  @include common-session
  session optional pam_ssh.so
  ...

By thus adding ssh-auth after common-auth, ssh-auth can use the user's
password to decrypt the user's traditional SSH keys (id_rsa, id_dsa,
id_ecdsa, or id_ed25519).


Another way to use pam_ssh is to instead change the above
/etc/pam.d/login to

  ...
  auth sufficient pam_ssh.so try_first_pass
  @include common-auth
  ...
  @include common-session
  session optional pam_ssh.so
  ...

which will ask the user for an SSH passphrase if the user has placed
any SSH keys in $HOME/.ssh/login-keys.d/ and then authenticate the
user if the passphrase decrypts any of these keys.  If the passphrase
fails, then PAM will fall back to the normal password authentication.
But notice that this method might leak information about existing
users.  Alternatively it is possible to use a setup similar to

  ...
  auth sufficient pam_unix.so nullok_secure
  auth required pam_ssh.so use_first_pass
  ...
  @include common-session
  session optional pam_ssh.so
  ...

to let each user login with either the unix password or the SSH
passphrase.  But notice that there will be 'failed login' notices in
the log whenever a user uses the passphrase instead of the password.

Yet another way to use pam_ssh is to change /etc/pam.d/login to

  ...
  auth required pam_ssh.so
  ...
  @include common-session
  session optional pam_ssh.so
  ...

which will unconditionally ask the user for a SSH passphrase, and only
authenticate the user if this passphrase decrypts any of the SSH keys
in $HOME/.ssh/login-keys.d/.


See also "man pam_ssh", and
http://content.hccfl.edu/pollock/AUnix2/PAM-Help.htm for a good
introduction to PAM.

 -- Jens Peter Secher <jps@debian.org>, Sun, 28 Feb 2010 12:49:51 +0100
 -- Jerome Benoit <calculus@rezozer.net>, Fri, 3 Jul 2013 14:59:15 +0200