commit 1cd43587e7c4be0fed727c7ba37cf67e82fc2611
parent a2afc40f8786d2193254c1243d424da00bfab2d3
Author: Jack Sangdahl <0x6A73@pm.me>
Date: Wed, 6 Mar 2024 15:09:39 -0700
key stuff
Diffstat:
5 files changed, 62 insertions(+), 5 deletions(-)
diff --git a/contact.html b/contact.html
@@ -4,7 +4,7 @@
<link rel="stylesheet" href="style.css">
</head>
<body>
- <a href="index.html"><--</a>
+ <a style="text-decoration: none;" href="index.html"><--</a>
<h2>Contact</h2>
Email: <a href="mailto:0x6A73@pm.me">0x6A73@pm.me</a><br>
Github: <a href="https://github.com/waffle87" target="_blank">waffle87</a>
diff --git a/extra.html b/extra.html
@@ -20,7 +20,7 @@
</style>
</head>
<body>
- <a href="index.html"><--</a>
+ <a style="text-decoration: none;" href="index.html"><--</a>
<h2>Some bits & bobs</h2>
Here lives some miscellaneous things I reference one or one hundred
times and figure they should be gathered somewhere.
@@ -101,5 +101,52 @@ ssh-add -l > /dev/null || ssh-add
# sysyadm add foo.conf
# sysyadm commit -m "foo"
</pre>
+ <h3>Hardware security key for authentication on Linux</h3>
+ Typing in a rather long password each time I log into my computer
+ or need to complete a privileged task can be bothersome. A couple
+ years ago I came across <a href="https://github.com/solokeys" target="_blank">solokeys</a>,
+ which are fully open source hardware and firmware security keys. I
+ chose to build the <a href="https://github.com/solokeys/solo-hw" target="_blank">Solo 1</a>
+ (or five because that's the MOQ from most PCB manufacturers). Note,
+ at the time of writing this, the <a href="https://github.com/solokeys/solo1-cli" target="_blank">solo1-cli</a>
+ tool is currently broken with the latest FIDO2 library, meaning
+ it must be installed explicitly at 0.9.3.
+ <pre>
+$ pip3 install solo1
+$ pip3 install fido2==0.9.3
+ </pre>
+ After building, I didn't use it much, as many services don't support
+ security keys quite yet, or required a paid subscription (I'm looking
+ at you, Bitwarden). Come a few months ago, I found <a href="https://github.com/Yubico/pam-u2f" target="_blank">Yubico's PAM for U2F</a>.
+ To use this, first ensure the <code>CONFIG_HIDRAW</code> and
+ <code>CONFIG_USB_HIDDEV</code> options are set in your kernel.
+ Next, obtain the module via package manager or compiling from source
+ and generate the authorisation mapping with your key inserted. The
+ created directory must be named <code>Yubico</code>, even if not
+ using a Yubico key. It can be overridden in <a href="https://github.com/Yubico/pam-u2f/blob/main/util.h#L14" target="_blank">util.h</a>
+ if you so choose.
+ <pre>
+$ mkdir ~/.config/Yubico
+$ pamu2fcfg > ~/.config/Yubico/u2f_keys
+Enter PIN for /dev/hidraw2:
+ </pre>
+ Assuming all has been successful, you can configure PAM services
+ to use the device. The following configures doas to utilise the
+ U2F module in the <code>/etc/pam.d/doas</code> file. The same line
+ can be added in other files where needed (eg. display manager,
+ <code>system-local-login</code>, etc.)
+ <pre>
+auth sufficient pam_u2f.so cue pinverification=0
+auth include system-auth
+...
+ </pre>
+ Above, <b>sufficient</b> indicates that authentication from the device
+ alone is enough to fully authenticate. Use <b>required</b> instead
+ if you want both password and device authentication to be required.
+ <b>cue</b> simply displays a prompt to press the button on the device
+ when needed to authenticate. <b>pinverification=0</b> disables the need
+ to entre the passphrase associated with your security key. Note, this
+ means your system can be accessed only with your key, and no password entry
+ of any type. Set the parameter to 1 if you'd like otherwise.
</body>
-</html
+</html>
diff --git a/gentoo.html b/gentoo.html
@@ -21,7 +21,7 @@
</style>
</head>
<body>
- <a href="index.html"><--</a>
+ <a style="text-decoration: none;" href="index.html"><--</a>
<h2>Gentoo Linux on Macbook Air</h2>
This page covers various features, nuances, notes, etc. of my
Gentoo system running on a 2012 Macbook Air. This laptop was
diff --git a/kernel.html b/kernel.html
@@ -14,7 +14,7 @@
</style>
</head>
<body>
- <a href="index.html"><--</a>
+ <a style="text-decoration: none;" href="index.html"><--</a>
<h2>Kernel Configuration Pseudo Guide</h2>
<h4>Current base: <a href="https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/?h=linux-6.7.y">Linux 6.7.y</a></h4>
This aims to be a guide for configuring a Linux kernel for a modern
diff --git a/template.html b/template.html
@@ -0,0 +1,10 @@
+<html lang="en">
+ <head>
+ <title>Title</title>
+ <link rel="stylesheet" href="style.css">
+ </head>
+ <body>
+ <a style="text-decoration: none;" href="index.html"><--</a>
+ <h2>Page Header</h2>
+ </body>
+</html>
