From 1cd43587e7c4be0fed727c7ba37cf67e82fc2611 Mon Sep 17 00:00:00 2001 From: Jack Sangdahl <0x6A73@pm.me> Date: Wed, 6 Mar 2024 15:09:39 -0700 Subject: key stuff --- contact.html | 2 +- extra.html | 51 +++++++++++++++++++++++++++++++++++++++++++++++++-- gentoo.html | 2 +- kernel.html | 2 +- template.html | 10 ++++++++++ 5 files changed, 62 insertions(+), 5 deletions(-) create mode 100644 template.html diff --git a/contact.html b/contact.html index 8bbc327..56735e2 100644 --- a/contact.html +++ b/contact.html @@ -4,7 +4,7 @@ - <-- + <--

Contact

Email: 0x6A73@pm.me
Github: waffle87 diff --git a/extra.html b/extra.html index 0009c5a..c9425ac 100644 --- a/extra.html +++ b/extra.html @@ -20,7 +20,7 @@ - <-- + <--

Some bits & bobs

Here lives some miscellaneous things I reference one or one hundred times and figure they should be gathered somewhere. @@ -101,5 +101,52 @@ ssh-add -l > /dev/null || ssh-add # sysyadm add foo.conf # sysyadm commit -m "foo" +

Hardware security key for authentication on Linux

+ Typing in a rather long password each time I log into my computer + or need to complete a privileged task can be bothersome. A couple + years ago I came across solokeys, + which are fully open source hardware and firmware security keys. I + chose to build the Solo 1 + (or five because that's the MOQ from most PCB manufacturers). Note, + at the time of writing this, the solo1-cli + tool is currently broken with the latest FIDO2 library, meaning + it must be installed explicitly at 0.9.3. +
+$ pip3 install solo1
+$ pip3 install fido2==0.9.3
+    
+ After building, I didn't use it much, as many services don't support + security keys quite yet, or required a paid subscription (I'm looking + at you, Bitwarden). Come a few months ago, I found Yubico's PAM for U2F. + To use this, first ensure the CONFIG_HIDRAW and + CONFIG_USB_HIDDEV options are set in your kernel. + Next, obtain the module via package manager or compiling from source + and generate the authorisation mapping with your key inserted. The + created directory must be named Yubico, even if not + using a Yubico key. It can be overridden in util.h + if you so choose. +
+$ mkdir ~/.config/Yubico
+$ pamu2fcfg > ~/.config/Yubico/u2f_keys
+Enter PIN for /dev/hidraw2:
+    
+ Assuming all has been successful, you can configure PAM services + to use the device. The following configures doas to utilise the + U2F module in the /etc/pam.d/doas file. The same line + can be added in other files where needed (eg. display manager, + system-local-login, etc.) +
+auth sufficient pam_u2f.so cue pinverification=0
+auth include system-auth
+...
+    
+ Above, sufficient indicates that authentication from the device + alone is enough to fully authenticate. Use required instead + if you want both password and device authentication to be required. + cue simply displays a prompt to press the button on the device + when needed to authenticate. pinverification=0 disables the need + to entre the passphrase associated with your security key. Note, this + means your system can be accessed only with your key, and no password entry + of any type. Set the parameter to 1 if you'd like otherwise. - diff --git a/gentoo.html b/gentoo.html index 13edf3c..e5335a7 100644 --- a/gentoo.html +++ b/gentoo.html @@ -21,7 +21,7 @@ - <-- + <--

Gentoo Linux on Macbook Air

This page covers various features, nuances, notes, etc. of my Gentoo system running on a 2012 Macbook Air. This laptop was diff --git a/kernel.html b/kernel.html index b4ee408..55b3d49 100644 --- a/kernel.html +++ b/kernel.html @@ -14,7 +14,7 @@ - <-- + <--

Kernel Configuration Pseudo Guide

Current base: Linux 6.7.y

This aims to be a guide for configuring a Linux kernel for a modern diff --git a/template.html b/template.html new file mode 100644 index 0000000..4ef127c --- /dev/null +++ b/template.html @@ -0,0 +1,10 @@ + + + Title + + + + <-- +

Page Header

+ + -- cgit v1.2.3