modules/yubikey: add support of yubico pam
This commit is contained in:
parent
0fe23e8bf8
commit
8e0a030085
3 changed files with 63 additions and 20 deletions
|
@ -7,7 +7,11 @@
|
|||
./users
|
||||
];
|
||||
|
||||
local.yubikey.enable = true;
|
||||
local.yubikey = {
|
||||
enable = true;
|
||||
serial = "28058247";
|
||||
unplug.enable = true;
|
||||
};
|
||||
|
||||
################################################################################
|
||||
# Services
|
||||
|
|
|
@ -11,7 +11,7 @@ in
|
|||
config = lib.mkIf cfg.enable {
|
||||
programs.i3lock = {
|
||||
enable = true;
|
||||
u2fSupport = lib.mkDefault config.local.yubikey.enable;
|
||||
u2fSupport = lib.mkDefault config.security.pam.u2f.enable;
|
||||
};
|
||||
|
||||
programs.xss-lock.enable = true;
|
||||
|
|
|
@ -1,32 +1,71 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let cfg = config.local.yubikey; in
|
||||
let
|
||||
cfg = config.local.yubikey;
|
||||
|
||||
control = if cfg.multi-factor.enable then "required" else "sufficient";
|
||||
in
|
||||
{
|
||||
options.local.yubikey = with lib; {
|
||||
enable = mkEnableOption "yubikey";
|
||||
|
||||
serial = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
};
|
||||
|
||||
multi-factor.enable = mkEnableOption "multi-factor" // { default = true; };
|
||||
|
||||
unplug = {
|
||||
enable = mkEnableOption "Do action when a Yubikey is unplugged";
|
||||
model = mkOption {
|
||||
type = types.str;
|
||||
default = "407";
|
||||
};
|
||||
command = mkOption {
|
||||
type = types.str;
|
||||
default = "${pkgs.systemd}/bin/loginctl lock-sessions";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = [ pkgs.yubikey-manager pkgs.yubikey-personalization ];
|
||||
|
||||
security.pam.u2f = {
|
||||
enable = true;
|
||||
control = "required";
|
||||
cue = lib.mkDefault true;
|
||||
};
|
||||
security.pam =
|
||||
if cfg.serial == null then
|
||||
{
|
||||
u2f = {
|
||||
enable = true;
|
||||
inherit control;
|
||||
cue = lib.mkDefault true;
|
||||
};
|
||||
|
||||
services.udev.packages = [ pkgs.yubikey-personalization ];
|
||||
security.pam.services = {
|
||||
login.u2fAuth = true;
|
||||
sudo.u2fAuth = true;
|
||||
};
|
||||
services.pcscd.enable = true;
|
||||
services = {
|
||||
login.u2fAuth = lib.mkDefault true;
|
||||
sudo.u2fAuth = lib.mkDefault true;
|
||||
};
|
||||
}
|
||||
else
|
||||
{
|
||||
yubico = {
|
||||
enable = true;
|
||||
inherit control;
|
||||
mode = "challenge-response";
|
||||
id = [ cfg.serial ];
|
||||
};
|
||||
};
|
||||
|
||||
services.udev.extraRules = lib.mkIf config.programs.xss-lock.enable ''
|
||||
ACTION=="remove",\
|
||||
ENV{DEVTYPE}=="usb_device",\
|
||||
ENV{PRODUCT}=="1050/402/543",\
|
||||
RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
|
||||
'';
|
||||
services.pcscd.enable = cfg.serial != null;
|
||||
|
||||
services.udev = {
|
||||
packages = [ pkgs.yubikey-personalization ];
|
||||
extraRules = lib.mkIf cfg.unplug.enable ''
|
||||
ACTION=="remove",\
|
||||
ENV{DEVTYPE}=="usb_device",\
|
||||
ENV{PRODUCT}=="1050/${cfg.unplug.model}/543",\
|
||||
RUN+="${cfg.unplug.command}"
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue