Shared screen locking solution for live distributions in Debian
Hi,
I'm part of the people working on Tails, a live distribution that aims at preserving privacy and anonymity: https://tails.boum.org/. Tails is currently lacking a screen locker and this has been a frequent feature request. See https://labs.riseup.net/code/issues/5684.
For example, as Tails is been adopted more and more by journalists, they want to be able to leave their computer unattended in their office to go to the toilets for a minute and have their screen locked.
I'm writing this emails to various Live distributions based on Debian (Knoppix, Grml, Jondo, Kali, Debian Live, and Tanglu). I'm also putting Micah Lee in copy as he has shown particular interest in this feature.
I've been investigating the screen locking mechanism of those various Debian based live distributions, and I found out that none of them had a real mechanism to do so. They either:
- Do not provide any screen locking mechanism (Knoppix, Grml, Jondo Live). - Either rely on their default password to unlock the screen (Kali, Tanglu, Debian Live).
The purpose of this email is to know whether you would be interested in working on a common Debian package to provide a generic screen locking solution for Debian based live distributions.
The core usability issue that we are facing here is the one of the unlocking password. As we are live distributions, there either is no password or a default one. Still, screen locking only make sense if the user is able to use a custom password. As an interesting exception, note that in Jondo Live, the user is prompted for a user password on boot. In Tails the user can set up an administration password but this is disabled by default for security reasons so we cannot rely on this for screen locking.
During our last monthly meeting we came up with the idea of asking for a custom password *in the process of locking the screen* for the first time. For example, in GNOME, when doing Meta+L for the first time, the user would be prompted to enter a screen locking password, then only the screen would get locked. If she locks the screen again, the same password would be reused.
What do you think? Please answer to tails-dev@boum.org and feel free to subscribe to the list to follow the thread:
https://mailman.boum.org/listinfo/tails-dev/
Hi,
On Fri, Jan 02, 2015 at 11:20:35AM +0000, sajolida wrote:
I've been investigating the screen locking mechanism of those various Debian based live distributions, and I found out that none of them had a real mechanism to do so. They either:
- Do not provide any screen locking mechanism (Knoppix, Grml, Jondo Live).
Grml has grml-lock[1], you should have set a proper password before using it, obviously ;)
Greets Evgeni
[1] https://github.com/grml/grml-scripts/blob/master/usr_bin/grml-lock
2015-01-02 13:41 GMT+01:00 Evgeni Golov evgeni@grml.org:
Hi,
On Fri, Jan 02, 2015 at 11:20:35AM +0000, sajolida wrote:
I've been investigating the screen locking mechanism of those various Debian based live distributions, and I found out that none of them had a real mechanism to do so. They either:
- Do not provide any screen locking mechanism (Knoppix, Grml, Jondo Live).
Grml has grml-lock[1], you should have set a proper password before using it, obviously ;)
FYI, note that Debian disabled the --new switch in vlock which limit now the desktop locking capability.
Here is what you can read in the NEWS file: vlock (2.2.2-4) unstable; urgency=medium This update disables the new.so plugin and thus the --new switch, because it proved too hard to fix it properly. See #702705.
See also: Debian Bug report logs - #702705 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702705
* Julien Jehannet [Fri Jan 02, 2015 at 04:19:10PM +0100]:
2015-01-02 13:41 GMT+01:00 Evgeni Golov evgeni@grml.org:
On Fri, Jan 02, 2015 at 11:20:35AM +0000, sajolida wrote:
I've been investigating the screen locking mechanism of those various Debian based live distributions, and I found out that none of them had a real mechanism to do so. They either:
- Do not provide any screen locking mechanism (Knoppix, Grml, Jondo Live).
Grml has grml-lock[1], you should have set a proper password before using it, obviously ;)
grml-lock actually checks if a password is set and if that's not the case then grml-lock prompts for setting one (to avoid locking yourself out).
FYI, note that Debian disabled the --new switch in vlock which limit now the desktop locking capability.
Here is what you can read in the NEWS file: vlock (2.2.2-4) unstable; urgency=medium This update disables the new.so plugin and thus the --new switch, because it proved too hard to fix it properly. See #702705.
See also: Debian Bug report logs - #702705 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702705
Meh, how sad. Thanks for the pointer, Julien.
regards, -mika-
Hi,
On Fri, Jan 02, 2015 at 11:20:35AM +0000, sajolida wrote:
I'm part of the people working on Tails, a live distribution that aims at preserving privacy and anonymity: https://tails.boum.org/. Tails is currently lacking a screen locker and this has been a frequent feature request. See https://labs.riseup.net/code/issues/5684.
[...]
I've been investigating the screen locking mechanism of those various Debian based live distributions, and I found out that none of them had a real mechanism to do so. They either:
- Do not provide any screen locking mechanism (Knoppix, Grml, Jondo Live).
At least for grml, that's wrong. grml-full ships vlock which can lock all consoles (and switching back to X) at once with the option "-a".
I though don't know if it works from under X, but it works fine if you switch to a text console first, e.g. with Ctrl-Alt-F1.
What do you think? Please answer to tails-dev@boum.org and feel free to subscribe to the list to follow the thread:
Cc'ed, but didn't subscribe.
Regards, Axel
Axel Beckert:
- Do not provide any screen locking mechanism (Knoppix, Grml, Jondo Live).
At least for grml, that's wrong. grml-full ships vlock which can lock all consoles (and switching back to X) at once with the option "-a".
Right. I tried both grml-lock as advertised by Evgeni and vlock as advertised by you.
Actually, grml-lock provides a similar user experience as the one that we imagined for Tails: if you didn't set a password it asks for one before locking the screen.
On the other hand as Julien pointed out, the --new option of vlock is broken right now and as a consequence grml-lock doesn't work. Both in a console and in X it errors with "vlock: loading plugin 'new' failed: No such file or directory". Shall I report a Grml bug about that?
Teilnehmer (5)
-
Axel Beckert -
Evgeni Golov -
Julien Jehannet -
Michael Prokop -
sajolida