Subject: Re: Define two factor authentication for Postgresql Server
To: pgsql-admin@postgresql.org
References: 
 <CAGVXacZeR0mky_txLs0cyP=BLRJN1vsTuQt5wj0aBM0eRhjMNA@mail.gmail.com>
From: "Gunnar \"Nick\" Bluth" <gunnar.bluth@pro-open.de>
Message-ID: <55E0A132.3010207@pro-open.de>
Date: Fri, 28 Aug 2015 19:58:10 +0200
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.2.0
MIME-Version: 1.0
In-Reply-To: 
 <CAGVXacZeR0mky_txLs0cyP=BLRJN1vsTuQt5wj0aBM0eRhjMNA@mail.gmail.com>
Content-Type: multipart/mixed; boundary="------------040709010004000904090108"
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

This is a multi-part message in MIME format.
--------------040709010004000904090108
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am 28.08.2015 um 16:29 schrieb Nima Azizzadeh:
> Hello, I'm going to create two factor authentication for pgadmin
> server... I'm using postgresql 9.4 with pgadmin III on Linux Mint
> 17.2 32bit... I already have 1 password authentication but For
> better security, I just want to force 2 of them. The authentication
> factors could be any things(what user has,what user knows,where
> user is or what user is). for example: The first factor is
> "password(what user knows)" and the second is "USB device(what user
> has)". I need to force Postgresql to check both for authenticate
> user and connect him to the server. I send you a screenshot from
> pgAdmin server authenticate screen and I'm going to implement 2 
> factor authentication for this. I not talking about OS
> authentication. All authenticate operation should operate from
> Postgresql.
> 
> I already try this for login into pgAdmin through password and
> USB: I installed pamusb pakages :
> 
> |sudo apt-get install pamusb-tools libpam-usb
> 
> |
> 
> Although I can add devices on my pamusb config file :
> 
> |pamusb-conf --add-device MyDevice |
> 
> and I can define pamusb users. I added this lines to pamusb config 
> between |<users>| tags :
> 
> |<user id="postgres"> <device>MyDevice</device> </user>
> 
> | |My guess : I think I should write module in /etc/pam.d and edit 
> pg_hba.conf file to define login method for local users : | |local
> all    all          pam     pamservice=mypam | |but I don't know
> how to write module to force both authentication methods for
> this(both are required).

Basically, what you need is two "auth required ..." lines in your
custom PAM config.

"man pam.conf" will give you more than enough information.

Keep in mind though that this will only work for databases that are
running on the machine that has the USB port in question (or get it
forwarded somehow)!
- -- 
Gunnar "Nick" Bluth
RHCE/SCLA

Mobil +49 172 8853339
Email: gunnar.bluth@pro-open.de
_____________________________________________________________
In 1984 mainstream users were choosing VMS over UNIX.
Ten years later they are choosing Windows over UNIX.
What part of that message aren't you getting? - Tom Payne

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQEcBAEBAgAGBQJV4KExAAoJEBAQrmsyiTOMZnMIALUtr2Q3x0uu5XjqESolkxoy
kyQTINkZ7aEUxNNZDvk+q9498h11xXxpZrFrCtSYYjmtmkcfXOmq73XmzHO3r2RJ
gIw89iSnzPVD/k5MruTbjkaCFOR6ROV+YtrOhh+TOk0Ha49ykOLWKTrX94d1SKjx
N2rB31gtW7BMd6+D2mD3H3v5a9ZQo4ZCYD59O/FBX0IN7+nyGX1c6oQ/YN1OYrmq
v4SxApOI8MjIr4nCDJnhD3hSRxX5uW9bRexceui/sIKLWgO2KMsBGoQuPemMsDzk
zdt7jfkri+kdjKgiMHoPEwVe+3AtXVEVlRHMZN2GGXGj33A8RnQJ0SyflZUtJ3k=
=C8kC
-----END PGP SIGNATURE-----

--------------040709010004000904090108
Content-Type: application/pgp-keys;
 name="0x3289338C.asc"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="0x3289338C.asc"

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.22 (MingW32)

mQENBFOuo7ABCADU3rFM4gBv4l/Xjfry27pfdYgvWrcR1RA/vLfOgjqivSbMQEHH
bTWprJRjB2EbzmTS+faSa/V+mH/jIKBytCc5+hprBd/m5if3/v2PKA7+MHsy1H9T
7FqTKRccNl7RIcKFOaonIbY4qMyH6cFafZOgqaGlc3ibfX7PiCL+mdl1mPoyWeVR
sKoddSobI40noE+se/FrnKZRDRWqqx7zvTRRK9vKUVDFM+Y3Kg3EDL3Qmt3MocM7
FtBZDaeyFZiKdf7bNaWM977aGwiA1gQQp+/TmB1qqSyOTzbPhxfr7G9vWdbVS2ph
80RSrxI/sF3LUNeJtTjB/jtKiG49arBqC1eDABEBAAG0Lkd1bm5hciAiTmljayIg
Qmx1dGggPGd1bm5hci5ibHV0aEBwcm8tb3Blbi5kZT6JAT8EEwECACkFAlOuo7AC
GyMFCQlmAYAHCwkIBwMCAQYVCAIJCgsEFgIDAQIeAQIXgAAKCRAQEK5rMokzjLin
CACaTXqjA7Qc6lpljpz3/5SpmPlvEDdX5mR76jN8326qkSQw7i8WBGW/5NO669OY
4ITlLbu/XL11x6hzCh7ZxMJo3fSYN+fh1tfEnNGw0NjUoy1JdBB+2B3beY+0LEBG
ZMm56HZC1u4qZq2drLM+sZIi6f8ML0NCh41s01SeX6hGQ609zCcFRNNk98pXOBER
a2kDi9wn1UvK1tECxCXuiO6HhPzhme/nFAxoBdBdATCl5EEnnLD+JfhSr2LShgXu
LQxJA6odvggfDVlS913rb0zDtV6s+6bfR+qmD4igBgC6Xl8ceDJpbS4ER7Uvw78n
Sa2i3Yub28FAGr+RvpFLi9PruQENBFOuo7ABCAC6E2x7GZ1LrIQMlNr2XYvCG9DB
p181PJJ95w4BwuaKmFBDHc5tE7p5S2sNfNfYNUjDzpr47lU5+85Ffqtf27gV8Ftd
rqv/d2lbH9+w6wShB9QOy11gPPdkB62o9CKwk+XInN2DJITWsgI8hk6NNzbotD27
x7x4fxQxBUE6YkHnJMziqwZ5emLFP0A2XPIDK6tw87UZNOnEaJ9kP3WOKihNOtMq
mr7+4BQQCyfj13k32219UZglnHtYaGuNmXOc0KHoFEIA2pkgeXRQShrwz4gdCaSN
FUZPAVeeWmdqAmnKKb+Sk7czft/wdtmBD0BykYRoZxQ3JlkHG7oH7wGXmi1TABEB
AAGJASUEGAECAA8FAlOuo7ACGwwFCQlmAYAACgkQEBCuazKJM4xN1wf+MPLXrQ10
LBRtYjD16LsvxDyEcSMoWGc26DO/TDsGwme2NVfL0JufExgdpvkk/x4wzBwdkYfF
dNKU3CyA+3T4FuKGL7RPrICJa+VdCvwMk8dzLqF0UgdfVHtCnUQoQmNnDD7gODw/
GTIKpWw+iEE2/EANAONXj7EC+VsW895/C5aQEZx++cSonrHFSSIUp1OGJoVlmFnJ
MFCTTElmayTcmfOwGHrn97Et5YePMOsyqWZas+URuJveoTdGhDToOIufECGb3WJa
J8rFL+ni3NKoiZhZMYVQ+XC8f64Mi5kXlfsylVu6kgCoFqnq7FTpwqOiRml4APeX
GBC6uZW6fUGNDQ==
=//tm
-----END PGP PUBLIC KEY BLOCK-----

--------------040709010004000904090108
Content-Type: application/octet-stream;
 name="0x3289338C.asc.sig"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="0x3289338C.asc.sig"

iQEcBAABAgAGBQJV4KEyAAoJEBAQrmsyiTOMmiwIAIpaTtzfI+2uzWm9OQtW
C3Vuy9IkvGzBmZdvwDGVA9hjthqjbp5PBuRwkoCu9aRe+q3E6DhAuP3Xpjuk
ZGgi/9Ulv+DEAErW0MyXvERTlzFoO+c3hw3BbWNgyC0wxMh8x2LUbwFazxU1
ZkLZ2C1z74OhQy9rDqG8vdFU5qv7+lFmX4pgq3DJ8PURZ+hsAdDd1h0sJu6Z
U9xG0BOZ9WpEdMg0oFwI1zXTN7UvJQEYyKaimotRtSw95YjK7ezSa3laBM2b
+d+6RqOu+d6ikFO0/7jZ/srIOIGmgJs+zZCGfy7Sq7E1eZ0g3UK0TQozbN5A
cTREzeXoe/chH2yr13fgUjM=

--------------040709010004000904090108
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0


-- 
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin

--------------040709010004000904090108--