hermes

Authenticate on linux by plugging your USB stick!

Demo: https://www.youtube.com/watch?v=W7L9FrIDYgU

Installation

Installing hermes

Note: for now, only a debian/ubuntu package is provided.

Download the debian package and install it:

$ sudo dpkg -i hermes_1.8_amd64.deb
$ sudo apt-get -f install

Preparing the usb stick

I recommend having 2 partitions on your usb stick: a very small one (hermes needs 266 bytes as of now, so allocate 2048 bytes to be safe), and another partition for your data.

Let's assume that the partition for hermes is /dev/sdb1, and your user is foo.

To make your usb stick an hermes device, run:

$ sudo hermes write /dev/sdb1 foo

You can see what hermes can do with hermes help. (Although for now, it can only run the write command seen above.)

Done!

You can now do exactly as in the video. When you need to login, plug in the usb stick, hit enter with an empty password, and you should be logged in!

Manual installation

If you're not on debian, here are the steps to manually install hermes.

Download the following (equivalent to your distribution) dependencies: gcc, sbcl, wget, buildapp, libpam0g-dev, libfixposix-dev.

Then run:

# Build hermes
$ git clone https://github.com/ralt/hermes
$ cd hermes/
$ make

# Install the built files
$ sudo make install

# Configure your system
$ sudo pam-auth-update # Select "Hermes"
$ sudo addgroup hermes

If you're using systemd, you can then run the following:

$ sudo systemctl enable hermes
$ sudo systemctl start hermes

If you're not using systemd, please look at the debian/services/hermes.service file and reproduce the equivalent for your init system.

From then on, you can follow the steps in Preparing the usb stick.

How does it work?

A string of 128 characters is put on the both usb stick and in the user's home directory. When connection time comes, the tokens are checked to see if they match. If they do, the user can be connected.

Every time there is a successful login, the token is regenerated, for security reasons.

Developer todo

• better error handling. Right now it's fprintf(stderr) or perror() everywhere, randomly. Make it consistent.

Technical process

The hermes write <device> <user> command will generate a 128-bytes token, and write it to both /etc/hermes/<user> and the device. On the device, it will first write 5 bytes to recognize an hermes device.

When login is needed, the PAM module will send the user to the /var/run/hermes.sock UNIX socket. The hermes-daemon service will then look in /dev/sd* for a hermes device (starts with bytes 82, 111, 98, 105, 110). If none exists, it sends "false" to the UNIX socket. If one exists, it compares with the token in /etc/hermes/<user>, and sends either "true" or "false" back to the UNIX socket. The PAM module just has to get the boolean result back and it can return it.

License

The project is provided under the MIT license.