modules/yubikey: add support of yubico pam

hosts/asus-gl553vd/configuration.nix

@@ -7,7 +7,11 @@
     ./users
   ];
 
-  local.yubikey.enable = true;
+  local.yubikey = {
+    enable = true;
+    serial = "28058247";
+    unplug.enable = true;
+  };
 
   ################################################################################
   # Services

modules/nixos/configs/lockscreen/i3lock.nix

@@ -11,7 +11,7 @@ in
   config = lib.mkIf cfg.enable {
     programs.i3lock = {
       enable = true;
-      u2fSupport = lib.mkDefault config.local.yubikey.enable;
+      u2fSupport = lib.mkDefault config.security.pam.u2f.enable;
     };
 
     programs.xss-lock.enable = true;

modules/nixos/configs/yubikey.nix

@@ -1,32 +1,71 @@
 { config, lib, pkgs, ... }:
 
-let cfg = config.local.yubikey; in
+let
+  cfg = config.local.yubikey;
+
+  control = if cfg.multi-factor.enable then "required" else "sufficient";
+in
 {
   options.local.yubikey = with lib; {
     enable = mkEnableOption "yubikey";
+
+    serial = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+    };
+
+    multi-factor.enable = mkEnableOption "multi-factor" // { default = true; };
+
+    unplug = {
+      enable = mkEnableOption "Do action when a Yubikey is unplugged";
+      model = mkOption {
+        type = types.str;
+        default = "407";
+      };
+      command = mkOption {
+        type = types.str;
+        default = "${pkgs.systemd}/bin/loginctl lock-sessions";
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.yubikey-manager pkgs.yubikey-personalization ];
 
-    security.pam.u2f = {
+    security.pam =
-      enable = true;
+      if cfg.serial == null then
-      control = "required";
+        {
-      cue = lib.mkDefault true;
+          u2f = {
-    };
+            enable = true;
+            inherit control;
+            cue = lib.mkDefault true;
+          };
 
-    services.udev.packages = [ pkgs.yubikey-personalization ];
+          services = {
-    security.pam.services = {
+            login.u2fAuth = lib.mkDefault true;
-      login.u2fAuth = true;
+            sudo.u2fAuth = lib.mkDefault true;
-      sudo.u2fAuth = true;
+          };
-    };
+        }
-    services.pcscd.enable = true;
+      else
+        {
+          yubico = {
+            enable = true;
+            inherit control;
+            mode = "challenge-response";
+            id = [ cfg.serial ];
+          };
+        };
 
-    services.udev.extraRules = lib.mkIf config.programs.xss-lock.enable ''
+    services.pcscd.enable = cfg.serial != null;
-      ACTION=="remove",\
+
-       ENV{DEVTYPE}=="usb_device",\
+    services.udev = {
-       ENV{PRODUCT}=="1050/402/543",\
+      packages = [ pkgs.yubikey-personalization ];
-       RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
+      extraRules = lib.mkIf cfg.unplug.enable ''
-    '';
+        ACTION=="remove",\
+         ENV{DEVTYPE}=="usb_device",\
+         ENV{PRODUCT}=="1050/${cfg.unplug.model}/543",\
+         RUN+="${cfg.unplug.command}"
+      '';
+    };
   };
 }