mynix/system
1
1
Fork 0
Code Issues 2 Pull requests Activity

modules/yubikey: add support of yubico pam

Browse source
This commit is contained in:
Dmitriy Pleshevskiy 2024-06-01 03:42:04 +03:00
parent 0fe23e8bf8
commit 8e0a030085
Signed by: pleshevskiy
GPG key ID: 17041163DA10A9A2
3 changed files with 63 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
hosts/asus-gl553vd/configuration.nix
View file

@ -7,7 +7,11 @@
./users
];
local.yubikey.enable = true;
local.yubikey = {
enable = true;
serial = "28058247";
unplug.enable = true;
};
################################################################################
# Services

2
modules/nixos/configs/lockscreen/i3lock.nix
View file

@ -11,7 +11,7 @@ in
config = lib.mkIf cfg.enable {
programs.i3lock = {
enable = true;
u2fSupport = lib.mkDefault config.local.yubikey.enable;
u2fSupport = lib.mkDefault config.security.pam.u2f.enable;
};
programs.xss-lock.enable = true;

71
modules/nixos/configs/yubikey.nix
View file

@ -1,32 +1,71 @@
{ config, lib, pkgs, ... }:
let cfg = config.local.yubikey; in
let
cfg = config.local.yubikey;
control = if cfg.multi-factor.enable then "required" else "sufficient";
in
{
options.local.yubikey = with lib; {
enable = mkEnableOption "yubikey";
serial = mkOption {
type = types.nullOr types.str;
default = null;
};
multi-factor.enable = mkEnableOption "multi-factor" // { default = true; };
unplug = {
enable = mkEnableOption "Do action when a Yubikey is unplugged";
model = mkOption {
type = types.str;
default = "407";
};
command = mkOption {
type = types.str;
default = "${pkgs.systemd}/bin/loginctl lock-sessions";
};
};
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ pkgs.yubikey-manager pkgs.yubikey-personalization ];
security.pam.u2f = {
security.pam =
if cfg.serial == null then
{
u2f = {
enable = true;
control = "required";
inherit control;
cue = lib.mkDefault true;
};
services.udev.packages = [ pkgs.yubikey-personalization ];
security.pam.services = {
login.u2fAuth = true;
sudo.u2fAuth = true;
};
services.pcscd.enable = true;
services.udev.extraRules = lib.mkIf config.programs.xss-lock.enable ''
ACTION=="remove",\
ENV{DEVTYPE}=="usb_device",\
ENV{PRODUCT}=="1050/402/543",\
RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
'';
services = {
login.u2fAuth = lib.mkDefault true;
sudo.u2fAuth = lib.mkDefault true;
};
}
else
{
yubico = {
enable = true;
inherit control;
mode = "challenge-response";
id = [ cfg.serial ];
};
};
services.pcscd.enable = cfg.serial != null;
services.udev = {
packages = [ pkgs.yubikey-personalization ];
extraRules = lib.mkIf cfg.unplug.enable ''
ACTION=="remove",\
ENV{DEVTYPE}=="usb_device",\
ENV{PRODUCT}=="1050/${cfg.unplug.model}/543",\
RUN+="${cfg.unplug.command}"
'';
};
};
}