PAM Duress

lastmod 2021-08-27created 2021-08-271 edits

A Pluggable Authentication Module (PAM) which allows the establishment of alternate passwords that can be used to perform actions to clear sensitive data, notify IT/Security staff, close off sensitive network connections, etc if a user is coerced into giving a threat actor a password.

A separate password for emergencies

Features

• duress code : a password that can be used when someone forces you to log in
  • Logging in with that password runs a script that wipes key information, restricts the network, or raises a security alarm
  • Can also run a process that deletes this pam_duress module itself
• Works transparently, so the person doing the coercing cannot see it
• Can be created per individual user or globally
  • Users can also run their own scripts even when the global password is used
• Ubuntu/Debian

See also

• Authentication

Favorite site

• Github - pam-duress