From 43f6ad0324d39e77fb7f7e0891011fc4096d4375 Mon Sep 17 00:00:00 2001 From: Jack Sangdahl <0x6A73@pm.me> Date: Wed, 6 Mar 2024 16:03:24 -0700 Subject: lock/unlock --- extra.html | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/extra.html b/extra.html index c9425ac..a75287d 100644 --- a/extra.html +++ b/extra.html @@ -147,6 +147,29 @@ auth include system-auth when needed to authenticate. pinverification=0 disables the need to entre the passphrase associated with your security key. Note, this means your system can be accessed only with your key, and no password entry - of any type. Set the parameter to 1 if you'd like otherwise. + of any type. Set the parameter to 1 if you'd like otherwise. Another + thing of interest was locking/unlocking my system automatically when + the key is removed/inserted, respectively. This can be achieved via + a custom udev rule that executes a script when a device matching + our key's VID/PID is plugged in. This script will use pamtester + to test for authentication success. +
+#!/bin/bash +if [ "$1" == "lock" ]; then + # lock system +else + if [ echo "" | pamtester login+ Now, a custom udev rule that lives inauthenticate ]; then + # kill lock program + fi +fi +exit 0 +
/etc/udev/rules.d/70-solokey.rules
+ and looks for a matching VID/PID and executes this script when
+ found with the appropriate argument.
+ +ACTION::"remove", ENV{DEVTYPE}::"usb_device", ENV{PRODUCT}::"0483/a2Ca", RUN+:"/usr/local/sbin/keyauth.sh lock" +ACTION::"add", ENV{DEVTYPE}::"usb_device", ENV{ID_BUS}::"usb", ENV{PRODUCT}::"0483/a2Ca", RUN+:"/usr/local/sbin/keyauth.sh unlock" +