7:19 a.m.
I'm not actually using fredora, but I want to be active at the 'google
summer of code'. I've got a strange idea for a project, and I think a
distribution is the best organization to call. My project has not
directly sth. to do with fredora, it's more 'distribution independ'.
Would fredora like to be to mentoring organization for such a project?
If so, I'd be happy to tell you more about my project.
9:07 a.m.
On Fri, 2005-06-03 at 14:19 +0200, ness wrote:
I'm not actually using fredora, but I want to be active at the
'google
summer of code'. I've got a strange idea for a project, and I think a
distribution is the best organization to call. My project has not
directly sth. to do with fredora, it's more 'distribution independ'.
Would fredora like to be to mentoring organization for such a project?
If so, I'd be happy to tell you more about my project.
Chicken and egg problem here, people probably can't answer unless they
know more about your proposal.
Nils
--
Nils Philippsen / Red Hat / nphilipp(a)redhat.com
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety." -- B. Franklin, 1759
PGP fingerprint: C4A8 9474 5C4C ADE3 2B8F 656D 47D8 9B65 6951 3011
9:23 a.m.
Nils Philippsen wrote:
On Fri, 2005-06-03 at 14:19 +0200, ness wrote:
>I'm not actually using fredora, but I want to be active at the 'google
>summer of code'. I've got a strange idea for a project, and I think a
>distribution is the best organization to call. My project has not
>directly sth. to do with fredora, it's more 'distribution independ'.
>Would fredora like to be to mentoring organization for such a project?
>If so, I'd be happy to tell you more about my project.
>
>
Chicken and egg problem here, people probably can't answer unless they
know more about your proposal.
Nils
OK, if I understand you right, I shall tell more about my project. My
first question was wether fredora would mentor a project not directly
connected to the fredora distribution. But more about my proposal:
The idea is an udev based authentication using an usb-stick. This means
following: I put the stick into the pc, then, if a loginmanger is
started, it will automaticly open a graphical session. If not, a shell
based session will start. I think I could add interesting expands to
that, such as automaticly open encrypted devices... I'd realize this
(means: writing patches for common dm, write the udev rule and so on)
and write config tools. If you want, I sent you a complete spec of what
I'd be going to do.
10:31 a.m.
On Fri, 2005-06-03 at 16:23 +0200, ness wrote:
Nils Philippsen wrote:
>On Fri, 2005-06-03 at 14:19 +0200, ness wrote:
>
>
>>I'm not actually using fredora, but I want to be active at the 'google
>>summer of code'. I've got a strange idea for a project, and I think a
>>distribution is the best organization to call. My project has not
>>directly sth. to do with fredora, it's more 'distribution independ'.
>>Would fredora like to be to mentoring organization for such a project?
>>If so, I'd be happy to tell you more about my project.
>>
>>
>
>Chicken and egg problem here, people probably can't answer unless they
>know more about your proposal.
>
>Nils
>
>
OK, if I understand you right, I shall tell more about my project. My
first question was wether fredora would mentor a project not directly
connected to the fredora distribution. But more about my proposal:
The idea is an udev based authentication using an usb-stick. This means
following: I put the stick into the pc, then, if a loginmanger is
started, it will automaticly open a graphical session. If not, a shell
based session will start. I think I could add interesting expands to
that, such as automaticly open encrypted devices... I'd realize this
(means: writing patches for common dm, write the udev rule and so on)
and write config tools. If you want, I sent you a complete spec of what
I'd be going to do.
This sounds interesting, consider auto-locking of the session (via
xscreensaver and/or vlock) when the USB stick is removed (just a random
idea I've been carrying around with me for a while). I could imagine
that you could do that within the "Fedora project space", but I'm not
the one doing decisions. Anybody else?
Nils
--
Nils Philippsen / Red Hat / nphilipp(a)redhat.com
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety." -- B. Franklin, 1759
PGP fingerprint: C4A8 9474 5C4C ADE3 2B8F 656D 47D8 9B65 6951 3011
10:45 a.m.
On 6/3/05, Nils Philippsen <nphilipp(a)redhat.com> wrote:
This sounds interesting, consider auto-locking of the session (via
xscreensaver and/or vlock) when the USB stick is removed (just a random
idea I've been carrying around with me for a while). I could imagine
that you could do that within the "Fedora project space", but I'm not
the one doing decisions. Anybody else?
Do you allow mutliple sticks? and multiple sessions? locking sessions
as sticks are removed and adding new sessions when a new stick is
inserted? If so how do you switch between sessions? How do you handle
device permissions in the case of multiple console sessions?
The switch between sessions problem is a problem we already have.
gdmflexiserver exists and is useful to do multiple sessions. It even
activates the screensaver lock when you swtich over to a new or
different session. So when you move back to the previous session you
have to provide a password. BUT.. we don't have a graphical mechanism
to switch back and forth between sessions and must use the ALT+CTL+F#
magic to navigate back and forth. Once you hit the locked session
screen.. there is no way to navigate out of that to another session
without using the 3 finger salute.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=128758
-jef
1:09 p.m.
Hm, pam_usb looks interesting. But there are some things I don't like:
-you have to enter your username first
-It's pam based - some guys don't like this
-It looks too big for something simple at all
-I think pam isn't the right place to do sth. like that, because it only
authenticates. It can't do any additional things like open an encrypted
device or so
But pam has some nice things that make it a goog place for sth.:
-much applications use it, so there're no patches needed at all
-it really does the authentication, so you don't need to safe the real
pass on the usbstick and can work with public/private keys
All in all I think it's better to write a new, not pam-based usblogin
using ipc, udev (OK, not all guys use udev, but I think it's the future,
pam isn't I think) and patches for the dm (theese aren't so much at all,
right?)
I thought to logout the user, if the usbstick is removed not locking the
session, but this only a config option I think...
OK, how ever, you've to decide whether you'd like to mentor this project.
1:21 p.m.
fre, 03.06.2005 kl. 16.23 skrev ness:
Nils Philippsen wrote:
>On Fri, 2005-06-03 at 14:19 +0200, ness wrote:
>
>
>>I'm not actually using fredora, but I want to be active at the 'google
>>summer of code'. I've got a strange idea for a project, and I think a
>>distribution is the best organization to call. My project has not
>>directly sth. to do with fredora, it's more 'distribution independ'.
>>Would fredora like to be to mentoring organization for such a project?
>>If so, I'd be happy to tell you more about my project.
>>
>>
>
>Chicken and egg problem here, people probably can't answer unless they
>know more about your proposal.
>
>Nils
>
>
OK, if I understand you right, I shall tell more about my project. My
first question was wether fredora would mentor a project not directly
connected to the fredora distribution. But more about my proposal:
The idea is an udev based authentication using an usb-stick. This means
following: I put the stick into the pc, then, if a loginmanger is
started, it will automaticly open a graphical session. If not, a shell
based session will start. I think I could add interesting expands to
that, such as automaticly open encrypted devices... I'd realize this
(means: writing patches for common dm, write the udev rule and so on)
and write config tools. If you want, I sent you a complete spec of what
I'd be going to do.
Interesting :)
Could the users homedir lie encrypted on such a device (say, a standard
usb memory stick), and when presented with such a stick, the machine
would ask for the users password (witch would also be the encryption
key, and log the user in? Could be really usefull for simple setups with
many users - say a school, or a village in India. With this setup, they
could hand out such sticks to student, witch they could plug into any
computer to login, or take home to retrive his/her data. Some
linux/windows/mac-based "client" must then be aviable to decrypt data.)
What about some kind of personal authentification using a gpg-key on the
stick? Problem is that if you have the stick, you should not be able to
retrive the key... But if the stick works as a decryption device (the
computer sends data to stick, stick decrypts using on-board CPU, sticks
sends unencrypted data to computer) - but that would require some HW
hacking.
Kyrre
1:14 p.m.
I've written a spec file for what I'd do (see attachment).
I don't wan't to press so., but there's not much time until June 14th,
the final deadlinev for applying to the google summer of code. It would
be really nice if so. could tell me whether my idea is accepted and
fredora would like o be the mentoring organization or not, because of if
not I've to ask so. other (eg. ubuntu), but I like the idea of a
community distribution like fredora.
### # # ###### # # # ####### # #
# ## ## # # # # # # # # #
# # # # # # # # # # # # # #
# # # # ###### # # # # # #######
# # # # ####### # # # # #
# # # # # # # # # # #
### # # # # # ##### # # #
--------------------
| 1. abstract |
| 2. dependecies |
| 3. parts |
| 4. functionality |
--------------------
1. abstract
-----------
impauth is a collection of tools that provide improved
authentication facilities using data stored on an usbstick.
You can store your username and pass and will be logged in
automatically. Also encrypted devices will be opened for you.
If you want, you can store your complete homedir on the
stick and log in on every pc that allows this.
impauth also provides a set of configuration-tools.
2. dependencies
---------------
impauth's basic layer is only udev-based. Of course,
you need ext2fs, too.
If you want to use the encryption facilities, you have to
have enabled dm_crypt, the aes cipher and loop device support
in the kernel and you need the cryptsetup program.
3. parts
--------
-the files /etc/udev/rules.d/_impauth.rules and
/etc/hotplug.d/usbstick/_impauth.dev
These are files for udev that map usbsticks to
/dev/usbstick, create symlinks to internal names
(such s /dev/sg0...) and do all necessary things if a
stick that is suited for impauth is detected.
-the programs timpauth,nimpauth,qimpauth,kimpauth and eimpauth
These are config tools for impauth. All configuration is
done through this. DON'T EDIT THE STICK ITSELF! These
programs can also be used to access a encrypted homedir
on the stick.
The names indicate the interface:
-timpauth is text-only
-nimpauth uses ncurses
-gimpauth " gtkmm
-qimpauth " qt
-eimpauth " the efl
-patches for xdm, gdm, kdm, entrance and agetty
4. functionality
----------------
there are two ways to use impauth (or, more correct, an usbstick
edited by one of the ?impauth tools), in local mode or in stand-
alone mode.
-local mode
You can use this stick unly at the pc it was configured
(ore on a more or less exactly same configured system).
facilities
automatic login
You can store your username and pass on the stick and
become logged in if you insert the stick
storing configs in an encrypted file (because of passwords
saved there)
all ~/.* are saved at a encrypted file at ~, symlinks
are created if the stick is inserted
problem: this is only useful if done before logging in
because otherwise the "local" config will be overridden
open encrypted devices
impauth can save the passwords and automatically open
encrypted devices/files
-stand-alone mode
You can use the stick on every pc that has impauth and allows
this feature, your complete home is stored on the stick
facilities
additional to those you have in local mode, you can save
your complete home on the stick. In this case, it's not
reasonable to work with encrypted devices. But you can save
the home encrypted, without saving the pass on the stick. This
has the following advantage: you can type your pass into a
patched dm's entry after inserting the stick. This pass is used
to decrypt the home directory on the stick. If this succeeds,
you get authenticated, else not.
2:56 a.m.
On Sun, 2005-06-05 at 20:14, ness wrote:
I've written a spec file for what I'd do (see attachment).
I don't wan't to press so., but there's not much time until June 14th,
the final deadlinev for applying to the google summer of code. It would
be really nice if so. could tell me whether my idea is accepted and
fredora would like o be the mentoring organization or not, because of if
not I've to ask so. other (eg. ubuntu), but I like the idea of a
community distribution like fredora.
Hi!
The FedoraBounties Wiki page mentioned in another thread says:
"If you would like clarification on any of these projects, have a great
idea for a project not listed here (doesn't even have to be
Fedora-specific!), or would like help applying, please e-mail
summerofcode05(a)fedora.redhat.com."
So that's probably the right place to send off your spec. The wiki is
here: http://fedoraproject.org/wiki/FedoraBounties
Good luck!
--
Tarjei
6909
days inactive
6912
days old
11 comments
5 participants
participants (5)
-
Jef Spaleta -
Kyrre Ness Sjobak -
ness -
Nils Philippsen -
Tarjei Knapstad