https://github.com/fiddlerwoaroof/dual-control

PAM Module for dual control
https://github.com/fiddlerwoaroof/dual-control

Last synced: 6 months ago
JSON representation

PAM Module for dual control

• Host: GitHub
• URL: https://github.com/fiddlerwoaroof/dual-control
• Owner: fiddlerwoaroof
• License: gpl-2.0
• Created: 2023-04-01T22:14:51.000Z (over 3 years ago)
• Default Branch: master
• Last Pushed: 2020-10-31T00:31:37.000Z (almost 6 years ago)
• Last Synced: 2026-01-30T19:49:55.143Z (6 months ago)
• Size: 983 KB
• Stars: 0
• Watchers: 0
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          

[![Build Status](https://travis-ci.org/cjdev/dual-control.svg?branch=master)](https://travis-ci.org/cjdev/dual-control)

# Dual Control

Dual Control is a PAM module that requires a user to input a generated token

from another user before being granted resource access. The module also

requires that the user input the reason for his or her access request and, via

`syslog`, captures all this information for future reference.

At **CJ Engineering**, we will be implementing Dual Control on our production

boxes to ensure that a single engineer cannot use sudo to gain

application-roles access without meeting the above-stated requirements.

Dual Control is an open source project licensed under the [GNU General Public

License](https://github.com/cjdev/dual-control/blob/master/LICENSE).  As it

stands, Dual Control is written only for machines running Linux. However, we

graciously welcome contributions, particularly those related to portability to

other operating systems.

## Status

This is in active development. Starting with the 0.2.0 release, this uses a

time-based OTP token generator.

## Install

- Obtain and install the RPM

  - build yourself using the code in https://github.com/cjdev/dual-control-rpm,

    or get it from a developer

- Edit the `/etc/pam.d/sudo`  (this is for CentOS 7, others may be different)

  - replace the existing auth lines with

```

#%PAM-1.0

# auth        include       system-auth

auth        required      pam_env.so

auth        required      pam_unix.so

auth        sufficient    pam_dual_control.so

auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success

auth        required      pam_deny.so

account     include       system-auth

password    include       system-auth

session     optional      pam_keyinit.so revoke

session     required      pam_limits.so

```

## Add a dual control token

From the authorizer's account home, run `dual_control`. This generates a secret

key for TOTP authentication and, if you have qrencode installed, generates a QR

code to scan.  Scan or enter this key in your authenticator app and then verify

that the token in your app matches the one on the screen (answer Y to the

prompt to get a more recent token).

## Use

- log in with a test user that has `sudo` ability (not the vagrant account it is

  too powerful)

- type `sudo bash`

- enter your password

- enter dual control token, authorizer's username + ':' + authorizer's token

## Build and test

- ./configure

- make

- make test