From 8180dafdafb01a2335244b4deae42fc18939e77d Mon Sep 17 00:00:00 2001 From: boltgolt Date: Mon, 24 Sep 2018 18:05:15 +0200 Subject: [PATCH] Fixed issue where remote sessions could be authenticated through howdy --- src/config.ini | 5 ++++- src/pam.py | 5 +++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/src/config.ini b/src/config.ini index ef65786..4e4416e 100644 --- a/src/config.ini +++ b/src/config.ini @@ -9,6 +9,9 @@ no_confirmation = false # show an error but fail silently suppress_unknown = false +# Disable Howdy in remote shells +ignore_ssh = true + # Auto dismiss lock screen on confirmation # Will run loginctl unlock-sessions after every auth # Expirimental, can behave incorrectly on some systems @@ -40,7 +43,7 @@ force_mjpeg = false # Set the camera input profile to this width and height # The largest profile will be used if set to -1 -# Automatically ignored if not a valid profile +# Automatically ignored if not a valid profile frame_width = -1 frame_height = -1 diff --git a/src/pam.py b/src/pam.py index 13e571b..5fd462e 100644 --- a/src/pam.py +++ b/src/pam.py @@ -19,6 +19,11 @@ def doAuth(pamh): if config.get("core", "disabled") == "true": sys.exit(0) + # Abort if we're in a remote SSH env + if config.get("core", "ignore_ssh") == "true": + if "SSH_CONNECTION" in os.environ or "SSH_CLIENT" in os.environ or "SSHD_OPTS" in os.environ: + sys.exit(0) + # Run compare as python3 subprocess to circumvent python version and import issues status = subprocess.call(["python3", os.path.dirname(os.path.abspath(__file__)) + "/compare.py", pamh.get_user()])