[Feature Request] Replacing pinentry to with pam_usb

[DhruvaSambrani]

Which version of pam_usb are you running?

master

Which distribution are you using?

Arch Linux

Which login manager and desktop environment are you using?

logind, DWM

What happened?

This is a Question/Feature request.

Is it possible to replace the pinentry program to auto-input the gnu pass password with pam-usb?

Output of "pamusb-check --debug whoami"

[src/local.c:227] Checking whether the caller (pamusb-check) is local or not...
[src/local.c:238] 	Checking pid 380537 (pamusb-check)...
[src/local.c:238] 	Checking pid 374691 (/usr/bin/zsh)...
[src/local.c:238] 	Checking pid 374679 (kitty)...
[src/local.c:238] 	Checking pid  97651 (dwm)...
[src/local.c:238] 	Checking pid  54120 (sh)...
[src/local.c:238] 	Checking pid  54076 (xinit)...
[src/local.c:238] 	Checking pid  54058 (/bin/sh)...
[src/local.c:238] 	Checking pid  10068 (-zsh)...
[src/local.c:238] 	Checking pid  10065 (login -- dhruva)...
[src/local.c:238] 	Checking pid      1 (/sbin/init)...
[src/local.c:297] 	Using DISPLAY :0 for utmp search
[src/local.c:050] 	No utmp entry found for tty ":0"
[src/local.c:313] 	Trying to get tty from display server
[src/local.c:318] 	Retrying with tty /dev/tty1, obtained from display server, for utmp search
[src/local.c:053] 		utmp entry for tty "tty1" found
[src/local.c:054] 			utmp->ut_pid: 10065
[src/local.c:055] 			utmp->ut_user: dhruva
[src/local.c:071] 		Checking utmp->ut_addr_v6[0]
[src/local.c:071] 		Checking utmp->ut_addr_v6[1]
[src/local.c:071] 		Checking utmp->ut_addr_v6[2]
[src/local.c:071] 		Checking utmp->ut_addr_v6[3]
[src/local.c:075] 	utmp check successful, request originates from a local source!
[src/local.c:375] No remote access detected, seems to be local request - allowing.
[src/device.c:038] Searching for "Key" in the hardware database...
* Authentication device "Key" is not connected.
* Access denied.

Output of "w"

01:25:34 up 1 day,  8:29,  1 user,  load average: 0.30, 0.51, 0.81
USER     TTY        LOGIN@   IDLE   JCPU   PCPU WHAT
dhruva   tty1      Wed16   30:00m 19:51   0.00s xinit /home/dhruva/.xinitrc -- /etc/X11/xinit/xserverrc :0 vt1 -keeptty -auth

Output of "loginctl"

SESSION  UID USER   SEAT  TTY 
      5 1000 dhruva seat0 tty1

1 sessions listed.

[mcdope]

I'm not familar with that software. How exactly does it work? I assume it either asks for the password or does get it from PAM like the gnome keyring does?

If it takes the password also via CLI/shell we could adopt an approach similar to https://github.com/mcdope/pam_usb/blob/master/tools/pamusb-keyring-unlock-gnome

[DhruvaSambrani]

https://www.gnupg.org/related_software/pinentry/index.html
Yeah I think so

[mcdope]

I cant find any easy searchable documentation there, splitted all over... So I cant really tell if can be done. But if it takes the password via shell then for sure the mentioned approach could be done.

If somebody submits a working pull request for that I will for sure merge it, but I don't intent to work on it myself in the foreseeable future.

[DhruvaSambrani]

@mcdope i knwo it has been forever since, but this is where the docs are:

https://info2html.sourceforge.net/cgi-bin/info2html-demo/info2html?(pinentry)Protocol

The following is a simple script that acts as a pinentry application:

#! /bin/python

import sys
import subprocess

a = subprocess.run(["pamusb-check", "dhruva"], capture_output=True)

if (a.returncode == 0):
    print("OK Pleased to meet you")
    while True:
        line = input().split()
        if line[0] == "GETPIN":
            print("D gpg-pass-here")
        elif line[0] == "BYE":
            exit()
        print("OK")
else:
    subprocess.run("/usr/bin/pinentry-gnome3")

That said, this is a MAJOR security gap, unless the gpg password can be stored on the usb

[mcdope]

Last reply is still current: "If somebody submits a working pull request for that I will for sure merge it, but I don't intent to work on it myself in the foreseeable future." :D Sorry.

[mcdope]

I just now realized that your script is pretty much a working PR, except without PR. Sorry for only skimming the script in May.

If I get your script correctly it sends the password gpg-pass-here to pinentry and that's already enough to unlock your key(s)? Then I will happily add it like the gnome keyring unlock.

[DhruvaSambrani]

No worries, this skipped my view too.

sends the password ...

Yes exactly. I have not dug into how GNOME keyring unlock stores the password, so similar security options would need to be set up for this too.

[mcdope]

@DhruvaSambrani Looking at it again, how is this supposed to be used?

To be called once (at startup/login or like that) to unlock the keys?
Or to be called instead of the "usual" (whatever that is) pinentry application?

[DhruvaSambrani]

We are supposed to provide an alternative pinentry program. Then, a user can change the pinentry program in ~/.gnupg/gpg-agent.conf. The pinentry program is run whenever the gpg-agent needs it (the agent can cache the password).

[mcdope]

Note to myself: check if we can provide it automatically via update-alternatives

https://superuser.com/a/1381147

sudo update-alternatives --install /usr/bin/pinentry pinentry /usr/bin/pamusb-pinentry 100

[mcdope]

@DhruvaSambrani There is now a branch / PR with the feature available. See the PR for setup instructions.

#250

Would be nice if you could test it somewhen

[DhruvaSambrani]

Hi, the typical way would be to provide pinentry-pamusb, and edit the gpg-agent conf file

[mcdope]

Did you had time to test the PR already? Waiting for your feedback before merging.