23 lines
2.4 KiB
Org Mode
23 lines
2.4 KiB
Org Mode
:PROPERTIES:
|
|
:ID: b72d2db1-f539-40b9-ade4-1253415049e2
|
|
:END:
|
|
|
|
#+title: azos/hardware-auth
|
|
#+filetags: :project: :knowledge: :hardware-auth:
|
|
|
|
** Architecture
|
|
- lauretta (ThinkPad T480) uses YubiKey U2F/FIDO2 (=pam_u2f=) as a "sufficient" PAM factor ahead of password, for both =sudo= and =login= (which =greetd=/=tuigreet= substacks) — see =features/hardware-auth/default.nix=, commit 1d66194.
|
|
- Default NixOS PAM rule ordering already tries u2f before pam_unix, both "sufficient" — no extra ordering config needed.
|
|
- Per-user enrollment (not machine state): =pamu2fcfg > ~/.config/Yubico/u2f_keys=; must be redone on each new machine.
|
|
|
|
** Gotchas
|
|
- lauretta's built-in fingerprint reader is a Synaptics Metallica MIS, USB ID =06cb:009a= — a match-on-chip sensor NOT supported by upstream libfprint (confirmed via openSUSE forum + a Launchpad bug for this exact device ID). =fprintd-enroll= fails with "GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice".
|
|
- =nixos-hardware='s =lenovo/thinkpad/default.nix= (imported by the t480 profile) only has a generic commented-out =services.fprintd.enable = true;= — no model-specific workaround, and no other ThinkPad profile there handles this sensor either.
|
|
- Raised upstream in nixos-hardware issue #521 ("[ThinkPad x270] Fingerprint reader does not work"). Commenter =ahbnr= (also has a T480) built custom packages for python-validity + open-fprintd + fprintd-clients, working via a manual =security.pam.services.sudo.text= override.
|
|
- That became a maintained flake: https://github.com/ahbnr/nixos-06cb-009a-fingerprint-sensor (55 stars, targets 06cb:009a specifically, tested on T480).
|
|
- BLOCKER: that flake's README says "With NixOS Unstable: Not supported" — only NixOS 24.11/23.11 stable. Our azos flake pins =nixpkgs-unstable= (=flake.nix:7=). Its issue tracker has an open "Update to 25.05" request (unresolved) and a closed issue about unstable builds failing with a patch error, confirming the incompatibility.
|
|
- Decision (2026-10-09): keep fingerprint disabled/unimplemented, documented only as a code comment in =features/hardware-auth/default.nix=. Revisit if (a) the ahbnr flake gets ported to nixpkgs-unstable/a newer stable release, or (b) it's worth pinning a second stable nixpkgs input just for this one package set.
|
|
|
|
** Key Files
|
|
- =features/hardware-auth/default.nix= — =azos.hardware-auth.enable=, wires up =security.pam.u2f=, option description documents the =pamu2fcfg= enrollment steps
|