diff options
author | Jack Sangdahl <[email protected]> | 2024-03-06 15:09:39 -0700 |
---|---|---|
committer | Jack Sangdahl <[email protected]> | 2024-03-06 15:09:39 -0700 |
commit | 1cd43587e7c4be0fed727c7ba37cf67e82fc2611 (patch) | |
tree | 38b8b9ec2649a49b59140ec3db495a3a209555ed | |
parent | a2afc40f8786d2193254c1243d424da00bfab2d3 (diff) | |
download | site-1cd43587e7c4be0fed727c7ba37cf67e82fc2611.tar.gz site-1cd43587e7c4be0fed727c7ba37cf67e82fc2611.zip |
key stuff
-rw-r--r-- | contact.html | 2 | ||||
-rw-r--r-- | extra.html | 51 | ||||
-rw-r--r-- | gentoo.html | 2 | ||||
-rw-r--r-- | kernel.html | 2 | ||||
-rw-r--r-- | template.html | 10 |
5 files changed, 62 insertions, 5 deletions
diff --git a/contact.html b/contact.html index 8bbc327..56735e2 100644 --- a/contact.html +++ b/contact.html @@ -4,7 +4,7 @@ <link rel="stylesheet" href="style.css"> </head> <body> - <a href="index.html"><--</a> + <a style="text-decoration: none;" href="index.html"><--</a> <h2>Contact</h2> Email: <a href="mailto:[email protected]">[email protected]</a><br> Github: <a href="https://github.com/waffle87" target="_blank">waffle87</a> @@ -20,7 +20,7 @@ </style> </head> <body> - <a href="index.html"><--</a> + <a style="text-decoration: none;" href="index.html"><--</a> <h2>Some bits & bobs</h2> Here lives some miscellaneous things I reference one or one hundred times and figure they should be gathered somewhere. @@ -101,5 +101,52 @@ ssh-add -l > /dev/null || ssh-add # sysyadm add foo.conf # sysyadm commit -m "foo" </pre> + <h3>Hardware security key for authentication on Linux</h3> + Typing in a rather long password each time I log into my computer + or need to complete a privileged task can be bothersome. A couple + years ago I came across <a href="https://github.com/solokeys" target="_blank">solokeys</a>, + which are fully open source hardware and firmware security keys. I + chose to build the <a href="https://github.com/solokeys/solo-hw" target="_blank">Solo 1</a> + (or five because that's the MOQ from most PCB manufacturers). Note, + at the time of writing this, the <a href="https://github.com/solokeys/solo1-cli" target="_blank">solo1-cli</a> + tool is currently broken with the latest FIDO2 library, meaning + it must be installed explicitly at 0.9.3. + <pre> +$ pip3 install solo1 +$ pip3 install fido2==0.9.3 + </pre> + After building, I didn't use it much, as many services don't support + security keys quite yet, or required a paid subscription (I'm looking + at you, Bitwarden). Come a few months ago, I found <a href="https://github.com/Yubico/pam-u2f" target="_blank">Yubico's PAM for U2F</a>. + To use this, first ensure the <code>CONFIG_HIDRAW</code> and + <code>CONFIG_USB_HIDDEV</code> options are set in your kernel. + Next, obtain the module via package manager or compiling from source + and generate the authorisation mapping with your key inserted. The + created directory must be named <code>Yubico</code>, even if not + using a Yubico key. It can be overridden in <a href="https://github.com/Yubico/pam-u2f/blob/main/util.h#L14" target="_blank">util.h</a> + if you so choose. + <pre> +$ mkdir ~/.config/Yubico +$ pamu2fcfg > ~/.config/Yubico/u2f_keys +Enter PIN for /dev/hidraw2: + </pre> + Assuming all has been successful, you can configure PAM services + to use the device. The following configures doas to utilise the + U2F module in the <code>/etc/pam.d/doas</code> file. The same line + can be added in other files where needed (eg. display manager, + <code>system-local-login</code>, etc.) + <pre> +auth sufficient pam_u2f.so cue pinverification=0 +auth include system-auth +... + </pre> + Above, <b>sufficient</b> indicates that authentication from the device + alone is enough to fully authenticate. Use <b>required</b> instead + if you want both password and device authentication to be required. + <b>cue</b> simply displays a prompt to press the button on the device + when needed to authenticate. <b>pinverification=0</b> disables the need + to entre the passphrase associated with your security key. Note, this + means your system can be accessed only with your key, and no password entry + of any type. Set the parameter to 1 if you'd like otherwise. </body> -</html +</html> diff --git a/gentoo.html b/gentoo.html index 13edf3c..e5335a7 100644 --- a/gentoo.html +++ b/gentoo.html @@ -21,7 +21,7 @@ </style> </head> <body> - <a href="index.html"><--</a> + <a style="text-decoration: none;" href="index.html"><--</a> <h2>Gentoo Linux on Macbook Air</h2> This page covers various features, nuances, notes, etc. of my Gentoo system running on a 2012 Macbook Air. This laptop was diff --git a/kernel.html b/kernel.html index b4ee408..55b3d49 100644 --- a/kernel.html +++ b/kernel.html @@ -14,7 +14,7 @@ </style> </head> <body> - <a href="index.html"><--</a> + <a style="text-decoration: none;" href="index.html"><--</a> <h2>Kernel Configuration Pseudo Guide</h2> <h4>Current base: <a href="https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/?h=linux-6.7.y">Linux 6.7.y</a></h4> This aims to be a guide for configuring a Linux kernel for a modern diff --git a/template.html b/template.html new file mode 100644 index 0000000..4ef127c --- /dev/null +++ b/template.html @@ -0,0 +1,10 @@ +<html lang="en"> + <head> + <title>Title</title> + <link rel="stylesheet" href="style.css"> + </head> + <body> + <a style="text-decoration: none;" href="index.html"><--</a> + <h2>Page Header</h2> + </body> +</html> |