diff options
author | Jack Sangdahl <[email protected]> | 2024-03-06 16:03:24 -0700 |
---|---|---|
committer | Jack Sangdahl <[email protected]> | 2024-03-06 16:03:24 -0700 |
commit | 43f6ad0324d39e77fb7f7e0891011fc4096d4375 (patch) | |
tree | 14ab78e4c0a708f81cc2e8600862287874ff1c83 | |
parent | 1cd43587e7c4be0fed727c7ba37cf67e82fc2611 (diff) | |
download | site-43f6ad0324d39e77fb7f7e0891011fc4096d4375.tar.gz site-43f6ad0324d39e77fb7f7e0891011fc4096d4375.zip |
lock/unlock
-rw-r--r-- | extra.html | 25 |
1 files changed, 24 insertions, 1 deletions
@@ -147,6 +147,29 @@ auth include system-auth when needed to authenticate. <b>pinverification=0</b> disables the need to entre the passphrase associated with your security key. Note, this means your system can be accessed only with your key, and no password entry - of any type. Set the parameter to 1 if you'd like otherwise. + of any type. Set the parameter to 1 if you'd like otherwise. Another + thing of interest was locking/unlocking my system automatically when + the key is removed/inserted, respectively. This can be achieved via + a custom udev rule that executes a script when a device matching + our key's VID/PID is plugged in. This script will use <a href="https://pamtester.sourceforge.net" target="_blank">pamtester</a> + to test for authentication success. + <pre> +#!/bin/bash +if [ "$1" == "lock" ]; then + # lock system +else + if [ echo "" | pamtester login <user> authenticate ]; then + # kill lock program + fi +fi +exit 0 + </pre> + Now, a custom udev rule that lives in <code>/etc/udev/rules.d/70-solokey.rules</code> + and looks for a matching VID/PID and executes this script when + found with the appropriate argument. + <pre> +ACTION::"remove", ENV{DEVTYPE}::"usb_device", ENV{PRODUCT}::"0483/a2Ca", RUN+:"/usr/local/sbin/keyauth.sh lock" +ACTION::"add", ENV{DEVTYPE}::"usb_device", ENV{ID_BUS}::"usb", ENV{PRODUCT}::"0483/a2Ca", RUN+:"/usr/local/sbin/keyauth.sh unlock" + </pre> </body> </html> |