agora inbox for pgsql-interfaces@postgresql.org
help / color / mirror / Atom feedDefine two factor authentication for Postgresql Server
2+ messages / 2 participants
[nested] [flat]
* Define two factor authentication for Postgresql Server
@ 2015-08-28 14:29 Nima Azizzadeh <n.azizzadeh@gmail.com>
2015-08-28 17:58 ` Re: Define two factor authentication for Postgresql Server Gunnar "Nick" Bluth <gunnar.bluth@pro-open.de>
0 siblings, 1 reply; 2+ messages in thread
From: Nima Azizzadeh @ 2015-08-28 14:29 UTC (permalink / raw)
Hello,
I'm going to create two factor authentication for pgadmin server...
I'm using postgresql 9.4 with pgadmin III on Linux Mint 17.2 32bit...
I already have 1 password authentication but For better security, I just
want to force 2 of them. The authentication factors could be any
things(what user has,what user knows,where user is or what user is).
for example:
The first factor is "password(what user knows)" and the second is "USB
device(what user has)". I need to force Postgresql to check both for
authenticate user and connect him to the server. I send you a screenshot
from pgAdmin server authenticate screen and I'm going to implement 2 factor
authentication for this. I not talking about OS authentication. All
authenticate operation should operate from Postgresql.
I already try this for login into pgAdmin through password and USB:
I installed pamusb pakages :
sudo apt-get install pamusb-tools libpam-usb
Although I can add devices on my pamusb config file :
pamusb-conf --add-device MyDevice
and I can define pamusb users. I added this lines to pamusb config between
<users> tags :
<user id="postgres"> <device>MyDevice</device> </user>
My guess : I think I should write module in /etc/pam.d and edit pg_hba.conf
file to define login method for local users :
local all all pam pamservice=mypam
but I don't know how to write module to force both authentication methods
for this(both are required).
Any help would be appreciated...
--
Sent via pgadmin-hackers mailing list (pgadmin-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgadmin-hackers
Attachments:
[image/png] sc.PNG (64.2K, ../../CAGVXacZeR0mky_txLs0cyP=BLRJN1vsTuQt5wj0aBM0eRhjMNA@mail.gmail.com/3-sc.PNG)
download | view image
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: Define two factor authentication for Postgresql Server
2015-08-28 14:29 Define two factor authentication for Postgresql Server Nima Azizzadeh <n.azizzadeh@gmail.com>
@ 2015-08-28 17:58 ` Gunnar "Nick" Bluth <gunnar.bluth@pro-open.de>
0 siblings, 0 replies; 2+ messages in thread
From: Gunnar \"Nick\" Bluth @ 2015-08-28 17:58 UTC (permalink / raw)
To: pgsql-admin@postgresql.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Am 28.08.2015 um 16:29 schrieb Nima Azizzadeh:
> Hello, I'm going to create two factor authentication for pgadmin
> server... I'm using postgresql 9.4 with pgadmin III on Linux Mint
> 17.2 32bit... I already have 1 password authentication but For
> better security, I just want to force 2 of them. The authentication
> factors could be any things(what user has,what user knows,where
> user is or what user is). for example: The first factor is
> "password(what user knows)" and the second is "USB device(what user
> has)". I need to force Postgresql to check both for authenticate
> user and connect him to the server. I send you a screenshot from
> pgAdmin server authenticate screen and I'm going to implement 2
> factor authentication for this. I not talking about OS
> authentication. All authenticate operation should operate from
> Postgresql.
>
> I already try this for login into pgAdmin through password and
> USB: I installed pamusb pakages :
>
> |sudo apt-get install pamusb-tools libpam-usb
>
> |
>
> Although I can add devices on my pamusb config file :
>
> |pamusb-conf --add-device MyDevice |
>
> and I can define pamusb users. I added this lines to pamusb config
> between |<users>| tags :
>
> |<user id="postgres"> <device>MyDevice</device> </user>
>
> | |My guess : I think I should write module in /etc/pam.d and edit
> pg_hba.conf file to define login method for local users : | |local
> all all pam pamservice=mypam | |but I don't know
> how to write module to force both authentication methods for
> this(both are required).
Basically, what you need is two "auth required ..." lines in your
custom PAM config.
"man pam.conf" will give you more than enough information.
Keep in mind though that this will only work for databases that are
running on the machine that has the USB port in question (or get it
forwarded somehow)!
- --
Gunnar "Nick" Bluth
RHCE/SCLA
Mobil +49 172 8853339
Email: gunnar.bluth@pro-open.de
_____________________________________________________________
In 1984 mainstream users were choosing VMS over UNIX.
Ten years later they are choosing Windows over UNIX.
What part of that message aren't you getting? - Tom Payne
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)
iQEcBAEBAgAGBQJV4KExAAoJEBAQrmsyiTOMZnMIALUtr2Q3x0uu5XjqESolkxoy
kyQTINkZ7aEUxNNZDvk+q9498h11xXxpZrFrCtSYYjmtmkcfXOmq73XmzHO3r2RJ
gIw89iSnzPVD/k5MruTbjkaCFOR6ROV+YtrOhh+TOk0Ha49ykOLWKTrX94d1SKjx
N2rB31gtW7BMd6+D2mD3H3v5a9ZQo4ZCYD59O/FBX0IN7+nyGX1c6oQ/YN1OYrmq
v4SxApOI8MjIr4nCDJnhD3hSRxX5uW9bRexceui/sIKLWgO2KMsBGoQuPemMsDzk
zdt7jfkri+kdjKgiMHoPEwVe+3AtXVEVlRHMZN2GGXGj33A8RnQJ0SyflZUtJ3k=
=C8kC
-----END PGP SIGNATURE-----
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Attachments:
[application/pgp-keys] 0x3289338C.asc (1.7K, ../../55E0A132.3010207@pro-open.de/2-0x3289338C.asc)
download
[application/octet-stream] 0x3289338C.asc.sig (287B, ../../55E0A132.3010207@pro-open.de/3-0x3289338C.asc.sig)
download
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2015-08-28 17:58 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2015-08-28 14:29 Define two factor authentication for Postgresql Server Nima Azizzadeh <n.azizzadeh@gmail.com>
2015-08-28 17:58 ` Gunnar "Nick" Bluth <gunnar.bluth@pro-open.de>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox