https://github.com/kde/kscreenlocker

Library and components for secure lock screen architecture
https://github.com/kde/kscreenlocker

Last synced: 4 days ago
JSON representation

Library and components for secure lock screen architecture

• Host: GitHub
• URL: https://github.com/kde/kscreenlocker
• Owner: KDE
• License: gpl-2.0
• Created: 2015-11-04T09:27:00.000Z (about 9 years ago)
• Default Branch: master
• Last Pushed: 2024-05-01T04:02:19.000Z (7 months ago)
• Last Synced: 2024-05-01T12:02:00.010Z (7 months ago)
• Language: C++
• Homepage: https://invent.kde.org/plasma/kscreenlocker
• Size: 2.99 MB
• Stars: 24
• Watchers: 4
• Forks: 10
• Open Issues: 0
• Metadata Files:
  • Readme: README.pam
  • License: COPYING

Awesome Lists containing this project

README

        
KScrenLocker and PAM

--------------------

KScreenLocker can be configured to support the PAM ("Pluggable Authentication

Modules") system for password checking (for unlocking the display).

PAM is a flexible application-transparent configurable user-authentication 

system found on FreeBSD, Solaris, and Linux (and maybe other unixes).

Information about PAM may be found on its homepage

      http://www.kernel.org/pub/linux/libs/pam/

(Despite the location, this information is NOT Linux-specific.)

Known Solaris Issues:

--------------------

For compiling PAM support on Solaris, PAM_MESSAGE_CONST must NOT

be defined. This should now be handled automatically by the

configure script.

Using PAM

---------

By default, PAM is automatically used, if it is found.

If PAM is found, Plasma by default uses the PAM service "kde". You may

override it for KScreenLocker by using -DKSCREENLOCKER_PAM_SERVICE=.

A valid PAM service definition must be specified, either by installing

files into /etc/pam.d/ or by adding service configuration to /etc/pam.conf.

Either a valid "kde" service must be installed (or copied from the "login"

service), or an alternative service must be specified using one of the

definitions above.  If the service is misconfigured, you will NOT be able

to unlock a locked screen!

If there is ever any doubt about which PAM service a program was

compiled with, it can be determined by examining the PAM-generated 

entries in the system log associated with KScreenLocker authentication

failures.

PAM configuration files have four types of entries for each service,

however KScreenLocker only uses the "auth" entries.  Other programs

using PAM may use other entries.

There may be more than one entry of each type. Check existing PAM

configuration files and PAM documentation on your system for guidance as

to what entries to make.  If you call a PAM service that is not

configured, the default action of PAM is likely to be denial of service.

Note: Screen lockers typically only authenticate a user to allow her to

continue working. They may also renew tokens etc., where supported.

See the Linux PAM Administrators guide, which is part of the PAM

distribution, for more details.