aner
1d661943cf
pam_u2f is set up as a sufficient factor ahead of password for sudo and login (which greetd/tuigreet substacks), so touching the key logs in without typing a password while leaving password as fallback. Fingerprint was investigated too but lauretta's reader is an unsupported match-on-chip sensor, documented in the feature instead of wired up. Also flip kubectl, qutebrowser-config, and snx-rs to disabled by default since they're unused. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
53 lines
1.8 KiB
Nix
53 lines
1.8 KiB
Nix
{...}: {
|
|
config.flake.modules.nixos.hardware-auth = {
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
options.azos.hardware-auth.enable = lib.mkOption {
|
|
default = false;
|
|
example = true;
|
|
type = lib.types.bool;
|
|
description = ''
|
|
Enables YubiKey (U2F/FIDO2) as a "sufficient" PAM factor ahead of
|
|
the password, for both sudo and login (which greetd/tuigreet
|
|
substacks) -- touch the key to auth, or just type your password as
|
|
normal if it's not plugged in.
|
|
|
|
After enabling and rebuilding, enroll each key on the new machine
|
|
(per-user, not machine-wide state, so this must be redone per
|
|
machine):
|
|
|
|
mkdir -p ~/.config/Yubico
|
|
pamu2fcfg > ~/.config/Yubico/u2f_keys
|
|
|
|
To add a second/backup key without overwriting the first:
|
|
|
|
pamu2fcfg -n >> ~/.config/Yubico/u2f_keys
|
|
|
|
Test with `sudo true` (touching the key) before trusting it on the
|
|
greeter -- a login lockout is harder to recover from than a failed
|
|
sudo in an already-open session.
|
|
'';
|
|
};
|
|
|
|
config = lib.mkIf config.azos.hardware-auth.enable {
|
|
# Default NixOS PAM rule ordering already tries u2f before pam_unix
|
|
# (password), both "sufficient" -- so YubiKey touch wins first,
|
|
# password always remains as fallback.
|
|
#
|
|
# Fingerprint (fprintd) is deliberately not wired up here: lauretta's
|
|
# reader is a Synaptics Metallica MIS (06cb:009a), a match-on-chip
|
|
# sensor unsupported by upstream libfprint. The only known fix is an
|
|
# unofficial python-validity + open-fprintd stack, not packaged in
|
|
# nixpkgs and fragile enough (suspend/resume, PAM lockout risk) to not
|
|
# be worth it for now.
|
|
security.pam.u2f = {
|
|
enable = true;
|
|
settings.cue = true;
|
|
};
|
|
};
|
|
};
|
|
}
|