From 43f6ad0324d39e77fb7f7e0891011fc4096d4375 Mon Sep 17 00:00:00 2001 From: Jack Sangdahl <0x6A73@pm.me> Date: Wed, 6 Mar 2024 16:03:24 -0700 Subject: lock/unlock --- extra.html | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/extra.html b/extra.html index c9425ac..a75287d 100644 --- a/extra.html +++ b/extra.html @@ -147,6 +147,29 @@ auth include system-auth when needed to authenticate. pinverification=0 disables the need to entre the passphrase associated with your security key. Note, this means your system can be accessed only with your key, and no password entry - of any type. Set the parameter to 1 if you'd like otherwise. + of any type. Set the parameter to 1 if you'd like otherwise. Another + thing of interest was locking/unlocking my system automatically when + the key is removed/inserted, respectively. This can be achieved via + a custom udev rule that executes a script when a device matching + our key's VID/PID is plugged in. This script will use pamtester + to test for authentication success. +
+#!/bin/bash
+if [ "$1" == "lock" ]; then
+    # lock system
+else
+    if [ echo "" | pamtester login  authenticate ]; then
+        # kill lock program
+    fi
+fi
+exit 0
+    
+ Now, a custom udev rule that lives in /etc/udev/rules.d/70-solokey.rules + and looks for a matching VID/PID and executes this script when + found with the appropriate argument. +
+ACTION::"remove", ENV{DEVTYPE}::"usb_device", ENV{PRODUCT}::"0483/a2Ca", RUN+:"/usr/local/sbin/keyauth.sh lock"
+ACTION::"add", ENV{DEVTYPE}::"usb_device", ENV{ID_BUS}::"usb", ENV{PRODUCT}::"0483/a2Ca", RUN+:"/usr/local/sbin/keyauth.sh unlock"
+    
-- cgit v1.2.3