Creating A Safe Directory With PAM And EncFS 

Contents

. Introduction
. Installation of encfs
. Installation of pam_script
. Adjusting PAM configuration
. The result

Introduction

I do work a lot with programs with require credentials
Examples of those programs are:
. mount.cifs
. fusesmb (look for details here)

Now, in my network (and others) the credentials provided at login could (and should) be used by those programs. How can you retrieve these credentials, providing enough security?
With a the PAM modules pam_script it's possible to store the password in a file, which will be used by fusemb and mount.cifs to read the password from.

To achieve security, one could make the user logging in owner and deny read/write for anybody else. Remove this file when the user ends his/her session.
This is enough, for runtime. But I was wondering, but what if the system crashes, and the file with the credentials remains on the harddrive? Anybody who is able to mount this harddrive with for example a lifecd, can read this file!

That's why I was looking for a was to encrypt this file.

With encfs this is very possible! At run time it gives an interface to encrypted files and directories, which does only exist at runtime! When the system is not running, there are only encrypted files, useless when you do not know the key to it. And this key is exactly the (encrypted) password! That's why I've chosen for a combination of PAM and Encfs.

Look for the website of Encfs: http://freshmeat.net/projects/encfs

This construction is intended to give enough security for run- and downtime (after a crash) to store sensitive information, not for creating a permanent safe directory on your harddrive to store documents.

Installation of encfs

Of course FUSE should be installed.
Installation is very straight forward:
(look at the website for rlog which is required by EncFs)

tar -xzf encfs-*.tar.gz
cd encfs-*
configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/sbin
make
make install

After installation you can test if it works:

mkdir -p ~/test/encrypted
mkdir -p ~/test/decrypted

encfs ~/test/encrypted ~/test/decrypted

mount (should show the just created mount)

echo "This is very secret." > ~/test/decrypted/testfile

The directory encrypted contains the encrypted files, and remains on the harddisk after unmounting and/or shutting down. The directory decrypted is the interface to it, and disappears when unmounted and/or shutting down.

The file testfile should appear in the decrypted directory, and in encrypted form in the encrypted directory. Name and content of the file are encrypted.

I've chosen for a seperate map in the local machine where for every user logging in a encrypted (and an interface to it) will be stored:

install -m777 -o root -g root /var/lib/encfs

Note the permissions: everybody must be able to create a directory here. Later in this document is explained why.

Installation of pam_script

Installation is very simple. After a make command move the library to the proper directory, /lib/security.

tar -xzf pam-script-*.tar.gz
cd pam-script-*
make
mv pam_script.so /lib/security
chown root:root /lib/security/pam_script.so
chmod 755 /lib/security/pam_script.so

Pam_script.so uses some parameters. All of them are described in the README in the source directory. Important are:

common parameters

- runas=#user# : makes the script called run as user #user#

parameters only in the auth part

- onauth=/path/to/onauth/script : path to script which is run when in auth part
default is /etc/security/onauth

only in the session part

- onsessionopen=/path/to/onsessionopen/script : path to script which is run when a (valid)session is started
default is /etc/security/onsessionopen

- onsessionclose=/path/to/onsessionclose/script : path to script which is run when a session is closed
default is /etc/security/onsessionclose

After installation the more complex thing is to configure the system to make use of this module.

Adjusting PAM configuration

I've used pam_script in the auth and in the session part of the pam (login,kde) service file.
First I describe howto adjust the auth part, where pam_script is used more than once.

The auth part

Pam_script has the ability (from version 0.1.5) to get the password provided at login, and make this via an evironmentvariable PAM_AUTHTOK available to scripts.

The purpose here is to create a safe directory where confidential information (like credentials) are stored.

The module is stacked in the authpart:

cat /etc/pam.d/login

-- snip --
auth                required        pam_shells.so
auth                required        pam_script.so expose=1
auth                sufficient        pam_unix.so use_first_pass
auth                sufficient        pam_ldap.so use_first_pass
auth                required        pam_script.so onauth=/etc/security/onauth.failed
auth                required        pam_deny.so

As you can see I use pam_scripts.so multiple times:

- The first time to run a script which creates an encrypted directory (with encfs) and to write the secret password to a file in this directory for use by credential sensitive programs like fusesmb and mount.cifs. This is done just before the first auth module following, pam_unix.

- The last time to run a script when authentication is not succesfull. When the preceding authmodules fail (pam_unix and pam_ldap) (and only then) this module is reached. It's neccasary to unmount the encrypted directory and to remove temporary files.

- Note that the last module of all is pam_deny, is really neccasary. Without it everybody is able to login. This is because pam_script always returns "PAM_SUCCESS", no matter what the return value is of the scripts.

Do not forget to add the flag "use_first_pass" to the existing module pam_unix.so.

The scripts

cat /etc/security/onauth

#!/bin/bash 
 
retcode=0; 
 
userid=$1 
service=$2 
authtok=$3 
 
if [ -z "$authtok" ]; then 
 
    authtok=$PAM_AUTHTOK 
 
fi; 
 
userproperties=$(getent passwd | grep -m 1 -E "^$userid") 
 
if [ -z "$userproperties" ]; then 
 
    # 
    # userproperties not found: something wrong 
    # 
 
    echo "User not found." 
    exit 
 
fi; 
 
homedir=$(echo $userproperties | cut -d ":" -f 6); 
gidnr=$(echo $userproperties | cut -d ":" -f 4); 
uidnr=$(echo $userproperties | cut -d ":" -f 3); 
 
if [ -d /var/lib/encfs ]; then 
 
    # create a safe 
 
    if [ ! -d /var/lib/encfs/$userid ]; then 
 
        install -m700 -o $uidnr -g $gidnr -d /var/lib/encfs/$userid 
 
    fi; 
 
    if [ ! -d /var/lib/encfs/$userid/encrypted ]; then 
 
        install -m700 -o $uidnr -g $gidnr -d /var/lib/encfs/$userid/encrypted 
 
    fi; 
 
    if [ ! -d /var/lib/encfs/$userid/unencrypted ]; then 
 
        install -m700 -o $uidnr -g $gidnr -d /var/lib/encfs/$userid/unencrypted 
 
    fi; 
 
    if [ ! -d /var/lib/encfs/$userid/run ]; then 
 
        install -m700 -o $uidnr -g $gidnr -d /var/lib/encfs/$userid/run 
        
    fi; 
 
    #
    # test the encrypted directory is not already mounted
    #
 
    if [ -z "$(mount | grep -w /var/lib/encfs/$userid/unencrypted )" ]; then 
 
        # 
        # create a password-provide-program 
        # 
 
        cd /var/lib/encfs/$userid 
 
        md5authsum=$(echo $authtok | md5sum | cut -d " " -f 1) 
 
        echo "$md5authsum" > run/tmp 
        echo "$md5authsum" >> run/tmp 
 
        chown $uidnr:$gidnr run/tmp 
 
        rm -rf encrypted/* 
        rm -f encrypted/.encfs* 
 
        cat run/tmp | encfs -S /var/lib/encfs/$userid/encrypted /var/lib/encfs/$userid/unencrypted -- -o allow_root 1>>/dev/null 
 
    fi; 
 
    # 
    # this is what's all about: storing the credentials in a file 
    # in this case the password 
    #  
 
    if [ -n "$(mount | grep -w /var/lib/encfs/$userid/unencrypted )" ]; then 
 
        cd /var/lib/encfs/$userid/unencrypted/ 
 
        if [ -f password.tmp ]; then 
 
                rm password.tmp 
 
        fi; 
 
        echo $authtok > password.tmp 
 
    fi; 
 
fi; 

Some remarks:

This scripts creates a encrypted directory (if it does not already exists) with encfs. Note the -S option at encfs: the password for this encrypted directory is read from stdin and not propmted for.
This password is the same as used at login.
The encrypted directory is at /var/lib/encfs/$userid.

The password is written to a file, password.tmp. This is a temporary file: the password does not have to be the correct one. Later in the process, depending on the success of the validation this file is renamed (to password) or removed.

Very important to notice is that the script is executed as the user logging in, not as root! And because programs like mount.cifs later need to have access to this directory to read the password file, the common fuseoption allow_root is added.

#!/bin/bash
userid=$1
service=$2
userproperties=$(getent passwd | grep -m 1 -E "^$userid")
if [ -z "$userproperties" ]; then
    #
    # userproperties not found: something wrong
    #
    echo "User not found."
    exit
fi;
homedir=$(echo $userproperties | cut -d ":" -f 6);
gidnr=$(echo $userproperties | cut -d ":" -f 4);
uidnr=$(echo $userproperties | cut -d ":" -f 3);
#
# this script is run when the authentication failed
# a safe encrypted is still created
# so it's important to remove this safe again
# 
if [ -d /var/lib/encfs ]; then
    if [ -d /var/lib/encfs/$userid/unencrypted ]; then
        #
        # test the encrypted directory is not already mounted
        #
        if [ -n "$(mount | grep -w /var/lib/encfs/$userid/unencrypted )" ]; then
            if [ $(w -h $userid | wc -l) -eq 0 ]; then
                
                #
                # this user is not logged in on more tty's
                # just remove everything and umount the encrypted directory
                #
                
                rm -rf /var/lib/encfs/$userid/unencrypted/*
                fusermount -u /var/lib/encfs/$userid/unencrypted
                
                rm -rf /var/lib/encfs/$userid/encrypted/*
                rm -f /var/lib/encfs/$userid/encrypted/.encfs*
            else
                #
                # this user is still logged in
                #
                
                rm -f /var/lib/encfs/$userid/unencrypted/password.tmp
                
            fi;
        
        fi;
        if [ -z "$(mount | grep -w /var/lib/encfs/$userid/unencrypted )" ]; then
        
                rm -rf /var/lib/encfs/$userid/encrypted/*
                rm -f /var/lib/encfs/$userid/encrypted/.encfs*
                rm -rf /var/lib/encfs/$userid/unencrypted/*
        fi;
        
    fi;
fi;

Some remarks:

This script is executed when the credentials provided are not valid. The encrypted directory, which has just been setup, wil be removed (unmounted) again and cleared. This is of course only when this user is not logged on any other tty.

The session part

When the session part is reached, it's sure that the credentials provided (password) are correct. This means that the password - in the the auth fase stored in a temporary file - is correct. So one thing to do in the session fase is to move the contents of the password.tmp to the permanent one, password.

A second thing is running scripts which need these credentials for own use, like mounting CIFS shares or fusesmb.
It's logical that any confidential information stays inside the safe directory. That's what it was all about in the first place!!

Note that this modules runs two scripts on default:
. /etc/security/onsessionopen : when a session start/opens;
. /etc/security/onsessionclose : when a session ends/closes.

I follow the default, there is no reason to do otherwise.

My /etc/pam.d/login file (the sessionpart) looks like:

cat /etc/pam.d/login

-- snip --
session                required        pam_mkhomedir.so
session                required        pam_motd.so
session                 optional        pam_mail.so empty dir=/var/mail
session                optional        pam_lastlog.so
session                required        pam_env.so
session                required        pam_script.so
session          required               pam_unix.so
session                required        pam_ldap.so

The scripts

On session open

cat /etc/security/onsessionopen

#!/bin/bash
retcode=0;
userid=$1
service=$2
userproperties=$(getent passwd | grep -E "^$userid")
if [ -z "$userproperties" ]; then
    #
    # userproperties not found: something wrong
    #
    
    echo "User not found."
    exit
    
fi;
homedir=$(echo $userproperties | cut -d ":" -f 6);
gidnr=$(echo $userproperties | cut -d ":" -f 4);
uidnr=$(echo $userproperties | cut -d ":" -f 3);
if [ -d /var/lib/encfs/$userid/encrypted ]; then
    #
    # test the encrypted directory is mounted
    #
    
    if [ -n "$(mount | grep -w /var/lib/encfs/$userid/unencrypted )" ]; then
    
        if [ -f /var/lib/encfs/$userid/unencrypted/password.tmp ]; then
        
            if [ -f /var/lib/encfs/$userid/unencrypted/password ]; then
            
                #
                # an old passwordfile found 
                #
                
                if [ -z "(diff /var/lib/encfs/$userid/unencrypted/password /var/lib/encfs/$userid/unencrypted/password.tmp)" ]; then
                
                    #
                    # new password and old one are the same
                    #
                    
                    rm /var/lib/encfs/$userid/unencrypted/password.tmp
                    
                else
                
                    mv /var/lib/encfs/$userid/unencrypted/password.tmp /var/lib/encfs/$userid/unencrypted/password
                
                fi;
            else
            
                #
                # password not found : it's the first login.
                # just move the temporary passwordfile to the remaining
                #
                
                mv /var/lib/encfs/$userid/unencrypted/password.tmp /var/lib/encfs/$userid/unencrypted/password
            
            fi;        
        
        fi;
        
        if [ -d /etc/session.d/pam/onsessionopen ]; then
        
            for script in /etc/session.d/pam/onsessionopen/*.sh; do
            
                if [ -x $script ]; then
            
                    eval $script $userid $service
                    
                fi
                
            done;
        
        fi;
        
    fi;
    
fi;

On session close

cat >> /etc/security/onsessionclose

#!/bin/bash
userid=$1
service=$2
userproperties=$(getent passwd | grep -E "^$userid")
if [ -z "$userproperties" ]; then
    #
    # userproperties not found: something wrong
    #
    echo "User not found."
    exit
fi;
homedir=$(echo $userproperties | cut -d ":" -f 6);
gidnr=$(echo $userproperties | cut -d ":" -f 4);
uidnr=$(echo $userproperties | cut -d ":" -f 3);
#
# this script is run when the authentication failed
# a safe encrypted is still created
# so it's important to remove this safe again
# 
if [ -d /var/lib/encfs ]; then
    if [ -d /var/lib/encfs/$userid/unencrypted ]; then
        #
        # test the encrypted directory is already mounted
        #
        if [ -n "$(mount | grep -w /var/lib/encfs/$userid/unencrypted )" ]; then
            if [ $(w -h $userid | wc -l) -eq 0 ]; then
        
                rm -rf /var/lib/encfs/$service.$userid/unencrypted/*
                fusermount -u /var/lib/encfs/$userid/unencrypted
                
                rm -rf /var/lib/encfs/$userid/encrypted/*
                rm -f /var/lib/encfs/$userid/encrypted/.encfs*
                
            fi;
        else
        
            rm -rf /var/lib/encfs/$userid/encrypted/*
        fi;
        
        if [ -d /etc/session.d/pam/onsessionclose ]; then
        
            for script in /etc/session.d/pam/onsessionclose/*.sh; do
                if [ -x $script ]; then
                    eval $script $userid $service
                fi
                
            done;
        
        fi;
    fi;
fi;

Some remarks:
. important: early versions of shadow (where the login program is a part of) did not close sessions on default (versions prior to 4.0.12). You'll have to add :

    CLOSE_SESSIONS yes

to the /etc/login.defs file.
This option is not documented, and not present in the login.defs file installed by the Shadow package. You'll have to add it yourself.
In newer versions this option is removed: the session is always closed.

The result

The encrypted directory contains now the credentials, which are only available to the owner and root. By creating a file mount.cifs.conf with these values:

touch /var/lib/encfs/$userid/unencrypted/mount.cifs.conf
chmod 600 /var/lib/encfs/$userid/unencrypted/mount.cifs.conf

echo "username=$userid" > /var/lib/encfs/$userid/unencrypted/mount.cifs.conf
echo -n "password=" >> /var/lib/encfs/$userid/unencrypted/mount.cifs.conf
cat /var/lib/encfs/$userid/unencrypted/password >> /var/lib/encfs/$userid/unencrypted/mount.cifs.conf

Now mounting a cifs share is possible with:

/sbin/mount.cifs //fileserver/public /home/sbon/netshares/fileserver/public -o credentails=/var/lib/encfs/sbon/unencrypted/mount.cifs.conf,ip=192.168.0.2

where the directory /home/sbon/netshares/fileserver/public does exist, and therse is a share "public" available on "fileserver", a smb/cifs server with ipnumber 192.168.0.2.
This command must be run as root. Root needs to have access to the encrypted directory.


An other example is fusesmb, which can use credentials to browse the smb networkneighbourhood. This is not done by creating a seperate file for the credentials only, but in the global-per-user configurationfile of fusesmb in ~/.smb/fusesmb.conf:
(here I create a simple configuationfile with credentials only)

touch /var/lib/encfs/sbon/unencrypted/fusesmb.conf
chmod 600 /var/lib/encfs/sbon/unencrypted/fusesmb.conf

echo "[global]" > /var/lib/encfs/sbon/unencrypted/fusesmb.conf
echo "username = sbon" >> /var/lib/encfs/sbon/unencrypted/fusesmb.conf
echo -n "password = " >> /var/lib/encfs/sbon/unencrypted/fusesmb.conf
cat /var/lib/encfs/sbon/unencrypted/password >> /var/lib/encfs/sbon/unencrypted/fusesmb.conf

ln -sf /var/lib/encfs/sbon/unencrypted/fusesmb.conf /home/sbon/.smb/fusesmb.conf

The last link is because fusesmb (started by sbon) expects the configuration file there.
Now start it with:

fusesmb /home/sbon/network

when I'm logged in as myself (sbon). The directory /home/sbon/network has to exist.