W dniu pią, 14.05.2021 o godzinie 10∶52 -0500, użytkownik David Wright
napisał:
> On Fri 14 May 2021 at 16:29:32 (+0200), Marek Mosiewicz wrote:
> >
> > I think of idea of having additional PAM module which passes login
> > after receiving and validating signed email (for some scenarios it
> > could even requires emails from many persons).
>
> That's all very vague. You need to specify a sequence of
> who has to do what, where, and how.
>
> After that, you have the problem of how/where you suspend
> this process until all^H^H^H the replies are received.
> (BTW I would suggest a quorum.)
> Normally, a successful login is fast; it's those that fail
> which take more time.
>
> > Signing emails can be
> > done easliy in secure way
>
> That's a separate issue.
>
> > and it could be also good for auditing.
>
> How?
If we have private key on crypto device we know that either admin gave
access or there is some physical interruption to admin office. It could
be done also by ssh key stored on crypto device, but email (possibly
auto forwarded somewhere)is proof that access has been really granted
which is not case for ssh where access logs can be altered.
>
> Cheers,
> David.
>
