From 1cd43587e7c4be0fed727c7ba37cf67e82fc2611 Mon Sep 17 00:00:00 2001 From: Jack Sangdahl <0x6A73@pm.me> Date: Wed, 6 Mar 2024 15:09:39 -0700 Subject: key stuff --- contact.html | 2 +- extra.html | 51 +++++++++++++++++++++++++++++++++++++++++++++++++-- gentoo.html | 2 +- kernel.html | 2 +- template.html | 10 ++++++++++ 5 files changed, 62 insertions(+), 5 deletions(-) create mode 100644 template.html diff --git a/contact.html b/contact.html index 8bbc327..56735e2 100644 --- a/contact.html +++ b/contact.html @@ -4,7 +4,7 @@
- <-- + <--+$ pip3 install solo1 +$ pip3 install fido2==0.9.3 ++ After building, I didn't use it much, as many services don't support + security keys quite yet, or required a paid subscription (I'm looking + at you, Bitwarden). Come a few months ago, I found Yubico's PAM for U2F. + To use this, first ensure the
CONFIG_HIDRAW
and
+ CONFIG_USB_HIDDEV
options are set in your kernel.
+ Next, obtain the module via package manager or compiling from source
+ and generate the authorisation mapping with your key inserted. The
+ created directory must be named Yubico
, even if not
+ using a Yubico key. It can be overridden in util.h
+ if you so choose.
+ +$ mkdir ~/.config/Yubico +$ pamu2fcfg > ~/.config/Yubico/u2f_keys +Enter PIN for /dev/hidraw2: ++ Assuming all has been successful, you can configure PAM services + to use the device. The following configures doas to utilise the + U2F module in the
/etc/pam.d/doas
file. The same line
+ can be added in other files where needed (eg. display manager,
+ system-local-login
, etc.)
+ +auth sufficient pam_u2f.so cue pinverification=0 +auth include system-auth +... ++ Above, sufficient indicates that authentication from the device + alone is enough to fully authenticate. Use required instead + if you want both password and device authentication to be required. + cue simply displays a prompt to press the button on the device + when needed to authenticate. pinverification=0 disables the need + to entre the passphrase associated with your security key. Note, this + means your system can be accessed only with your key, and no password entry + of any type. Set the parameter to 1 if you'd like otherwise. -