Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

I've been happily using blueproximity in 13.10, but since upgrade to 14.04 it only locks when my phone goes out of range (using gnome-screensaver-command -l), but it does not unlock with gnome-screensaver-command -d.

Now the reason that gnome-screensaver-command -d doesn't work is because of a bug.

However on that bug report it is mentioned that the gnome-screensaver is no longer used in trusty and therefore the gnome-screensaver-command is expected to be phased out, which could also be related to why the command doesn't work.

So my question is, if the gnome-screensaver is replaced, then what would be the new command to unlock the screen without relying on gnome-screensaver-command?

share|improve this question
    
@Braiam This question is specific to 14.04 and later. Why did you remove the tag? There is no reason why to avoid using gnome-screensaver-command in earlier versions! –  d_inevitable May 18 '14 at 21:25
    
Yourself answered: 14.04 and later. 14.04 should be used only if that's the only version affected, which is not true since 14.10 has it. BTW, do not ask about bugs. –  Braiam May 18 '14 at 21:45
    
@Braiam 1. I do not know about later!! How can I? There is no later version yet. As of now it is only 14.04. And I did not ask about bugs. So if you don't mind, I will revert your edit. –  d_inevitable May 18 '14 at 21:47
    
Seriously? cdimage.ubuntu.com/daily-live/current try it out. –  Braiam May 18 '14 at 21:50
    
@Braiam that is not a release. –  d_inevitable May 18 '14 at 21:51

4 Answers 4

So, I figured the "best" way to do this (apocryphal, since we're still storing a password and faking typing it into a thing) would be to, as I commented above, encrypt the password to the entry USB key. It's a little messy of a script, so I'll explain what's going on.

The devices for the current user are enumerated by looking through /etc/pamusb.conf with xpath; each one is then mated with its UUID using xpath, and the UUID mapped to a device using blkid.

You have the choice to lock, unlock show device, or set up your key. When you run setup, it'll create ~/.ssh/pamusb_rsa if it doesn't exist. You'll then be asked to pick a device (or not, if there's only one), and to enter your password. Your PW will be stored, encrypted, in {device}/.pamusb/.auth.

When you run unlock, the devices are enumerated again, and checked one by one for a /.pamusb/.auth file. When one's spotted, decryption will be attempted and, if successful, will be used to type your password into whatever happens to be accepting text at the moment. It will only permit run when the session is locked, so hopefully, this isn't going to expose you too bad.

I named this ~/.bin/unity-lock-control (~/.bin is on my path), and have "unity-lock-control lock" and "unity-lock-control unlock" as my agents in pam.conf.

#!/bin/bash
PAM_KEY=${HOME}/.ssh/pamusb_rsa
devices() {
    local NAMES NAME UUID DEV
    NAMES=$(xmllint /etc/pamusb.conf --xpath '//user[@id="'$USER'"]/device')
    NAMES=${NAMES//"<device>"/""}
    NAMES=${NAMES//'</device>'/' '}
    for NAME in $NAMES; do
        UUID=$(xmllint /etc/pamusb.conf --xpath '//device[@id="'$NAME'"]/volume_uuid/text()')
        DEV=$(blkid -U $UUID)
        if [[ -n $DEV ]]; then
            echo ${NAME}:${UUID}:${DEV}
        fi
    done
}
locked() {
    LS=$(ps -A -o cmd | grep 'unity-panel-service --lockscreen-mode' | grep -v grep)
    if [[ -z $LS ]]; then
        return -1
    else
        return 0
    fi
}
mounted() {
    MOUNTED=$(grep $1 /proc/mounts)
    if [[ -z $MOUNTED ]]; then
        return -1
    fi
    return 0
}
mount_point() {
    cat /proc/mounts | grep $1 | cut -d \  -f 2
}
case "$1" in
    devices)
        devices
        exit 0
    ;;
    lock)
        setsid paplay /usr/share/sounds/ubuntu/stereo/service-logout.ogg &
        setsid gnome-screensaver-command -l &
        sleep 1
        exit
    ;;
    unlock)
        if ! locked; then
            echo "Screen is not locked" >&2
            exit 1
        fi
        if [[ ! -f $PAM_KEY ]]; then
            echo "${PAM_KEY} does not exist; please run $0 setup." >&2
            exit 1
        fi

        DEVICES=$(devices)
        for device in $DEVICES; do
            NAME=$(echo $device | cut -d : -f 1)
            UUID=$(echo $device | cut -d : -f 2)
            DEV=$(echo $device | cut -d : -f 3)
            mounted $DEV
            MOUNTED=$?
            if [[ $MOUNTED -ne 0 ]]; then
                udisksctl mount -b $DEV
            fi
            AUTH_FILE=$(mount_point $DEV)/.pamusb/.auth
            if [[ -f $AUTH_FILE ]]; then
                PASS=$(openssl rsautl -decrypt -inkey $PAM_KEY -in $AUTH_FILE)
            fi
            if [[ $MOUNTED -ne 0 ]]; then
                udisksctl unmount -b $DEV
            fi
            if [[ -n $PASS ]]; then
                xdotool type --delay 0 "${PASS}" 
                xdotool key Return
                sleep 1
                if locked; then
                    setsid paplay /usr/share/sounds/ubuntu/stereo/service-login.ogg &
                else
                    setsid paplay /usr/share/sounds/ubuntu/stereo/dialog-warning.ogg &
                fi
                exit 0
            fi
        done
        echo "Did not find unlock key" >&2
        exit 1
    ;;
    setup)
        echo "This will set up an OpenSSL key, and encrypt your password to be stored"
        echo "on a pamusb authenticator."
        echo "-----"
        if [[ ! -d ${HOME}/.ecryptfs || ! -d ${HOME}/.Private ]]; then
            echo "Warning: Home folder is NOT encrypted" >&2
            read -p "Continue (y/N):" conf
            if [[ -z $conf ]]; then exit 1; fi
            if [[ $conf == "n" || $conf == "N" ]]; then exit 1; fi
        fi
        mkdir -p $(dirname $PAM_KEY)
        if [[ ! -f $PAM_KEY ]]; then
            openssl genrsa -out $PAM_KEY 1024
        fi
        DEVICES=$(devices)
        if [[ "${#DEVICES[@]}" -eq 1 ]]; then
            device="${DEVICES[0]}"
        else
            echo "Please select the device you would like to contain your encrypted password"       
            for i in "${!DEVICES[@]}"; do
                echo "$i: ${DEVICES[$i]}"
            done
            read selection
            device="${DEVICES[$selection]}"
        fi
        NAME=$(echo $device | cut -d : -f 1)
        UUID=$(echo $device | cut -d : -f 2)
        DEV=$(echo $device | cut -d : -f 3)

        mounted $DEV
        MOUNTED=$?
        if [[ $MOUNTED -ne 0 ]]; then
            echo "${NAME} is not mounted; attempting mount"
            udisksctl mount -b $DEV
        fi
        AUTH_FILE=$(mount_point $DEV)/.pamusb/.auth
        if [[ -f $AUTH_FILE ]]; then
            echo "Storing encrypted password to ${DEVICES[0]}"
            read -sp "Please enter your UNIX password:" PASS
            echo ""
            echo $PASS | openssl rsautl -encrypt -inkey $PAM_KEY -out $AUTH_FILE
        fi
        if [[ $MOUNTED -ne 0 ]]; then
            echo "${NAME} was not mounted; unmounting"
            udisksctl unmount -b $DEV
        fi
        exit 0
    ;;
    *)
        echo "Control for lock screen"
        echo $0 '{start|stop|devices|setup}'
        exit 1
    ;;
esac
share|improve this answer

This worked for me:

On the command line:

gsettings set org.gnome.desktop.a11y.applications screen-keyboard-enabled true

The on-screen keyboard appears when you first sign-in but you can close it.

Taken from benshayden on https://bugs.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/1307163

share|improve this answer
    
This should be much higher rated than the other answers. You should not put your password in these scripts, this is really bad! –  Patrick Cornelissen Jun 2 at 12:01

There is no way of doing this unfortunately :(

Update - I have found a way. Check out my newer answer

This is my previous solution - It is unadvisable to use, it is not unlockable if you lose your phone; you have to restart to unlock it

I eventually came up with a solution - don't lock it in the first place. This may sound odd - bear with.

Instead of locking it, I disabled the Mouse and Keyboard, hid all desktop icons and then switched to the desktop. You could possibly hide more stuff (like the launcher) but I have that hidden anyway.

This command requires a bit of setup.

Install : xdotool - sudo apt-get install xdotool

Enter: xinput --list and note down your mouse and keyboard ids.

I would suggest editing these commands in gedit

This one acts as the locker.

xinput set-prop <Keyboard ID> 'Device Enabled' 0 && xinput set-prop <Mouse ID> 'Device Enabled' 0 && gsettings set org.gnome.desktop.background show-desktop-icons false && wmctrl -k on

This acts as the unlock.

xinput set-prop <Keyboard ID> 'Device Enabled' 1 && xinput set-prop <Mouse ID> 'Device Enabled' 1 && gsettings set org.gnome.desktop.background show-desktop-icons true && wmctrl -k off

Change the and to their respective numbers, in both commands.

In order this:

  • Disables / Enables the Keyboard
  • Disables / Enables the Mouse
  • Hides / Shows all your desktop icons
  • Toggles showing your desktop.

One important thing to bear in mind - this can't be undone without your bluetooth device. If for some reason it fails, you have to restart. Because of that, it might be advisable to leave the keyboard enabled, and set up the unlock command to a chosen shortcut.

share|improve this answer
    
Hey nice idea! Would it be possible to change such that any keyboard input will lock the screen instead (giving a chance of unlocking it without the bluetooth device) instead of ignoring all keyboard input? –  d_inevitable May 16 '14 at 15:40
    
That's even better! I was just about to post another idea, but I'll get working on that! –  Tim May 16 '14 at 16:24
    
@d_inevitable Have a look at my new answer, it is neater (especially the 2nd method). I'm pretty sure it works. –  Tim May 17 '14 at 19:48

Update! There is a way to use the normal lock screen! Yay!

I don't know how secure it is (storing your password in plaintext), but I think it is the best possible.

This is the lock command: gnome-screensaver -d

There are 2 unlock commands:

No1:

This is the 1st unlock command:

gnome-screensaver -d && xdotool type mypassword12 && xdotool key Return

The click is to wake it up (it should click inside the login box, because of the mouse move), and show the nice new lock screen, instead of the "sleeping" black screen.

Then it types mypassword123! with an enter, to submit it, into the text box.

Important. For some reason - probably because of what xdotool is actually meant to be used for (keyboard shortcuts) - you can't enter double letters. To get around this, split it into 2 commands at each double letter (as above). Also, numbers have to have their own, separate command from letters (also above). Finally, modifiers (such as shift) need a separate one, as does the Return key.


No2:

This is the second one. It is a bit better and less hackish, but requires a lot of setting up.

First install actionaz:

sudo apt-get install actionaz

Open a new script, and drag in the correct items to your flow. (you can download the completed one here. If you chose to download this, open it, double click on Write text - Password here, and enter your password).

  1. Pause: enter 3 seconds.
  2. Click: copy and paste 165:555 into the Position box. (Depending on screen side, this may be different. Make sure it is clicking in the password box, otherwise it doesn't work).
  3. Write text: enter your password in the box
  4. Key: Click in the box and press Return

Save it in your home folder as unlock.ascr (or any name - I just didn't want to advertise that it had my password in it)

Set up your proximity command to be:

xdotool mousemove 0 0 && actionaz unlock.ascr -ex

The mouse move wakes it up, and the options tell it to execute the script and then exit at the end.


If you lose your device, you can always just type your password, so it is reversible.

share|improve this answer
    
Hey, this look pretty good, but unfortunately storing password in clean text is not option. Its almost as bad a running everything in root as my user is on the sudoers list. But I think a combination of your two answers would work. I will try something out as soon as i can. Basically dim the screen until the mouse moves, a key is pressed or the bluetooth device comes back in range. If mouse moves or key is pressed, switch the screen back on and run gnome-screensaver-command -l so that a password can be entered while the bluetooth device is absent. I think it should be doable. –  d_inevitable May 18 '14 at 21:22
    
I did quickly look at the 'mouse move' option... I was thinking that xev might be able to do that?you could set it up that the mouse moves over the xev window, and if the output changes, you know something has happened. –  Tim May 19 '14 at 15:01
    
Agree, storing password in plain text is pretty bad. Having your homedir encrypted - as I think is the default now in Ubuntu - would make it a bit less bad though. I've played a bit around with it, and actually find solution #1 far easier, and don't really consider it all that hackish. Made a small change though. Instead of the mousemove, I put in gnome-screensaver -d as that still wakes up the screen and enables me to have a much shorter sleep (I got it set now to 0.1, but wonder if it's needed at all) –  Wouter Van Vliet Jul 2 '14 at 13:43
    
I was thinking that I could write a file on the key with my password, encrypted using my key from .ssh/id_rsa, and write a script to decrypt and enter it for login. I'll let you know if I have any success. –  Fordi Jun 18 at 4:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.