Yubikey: Difference between revisions
mNo edit summary |
No edit summary |
||
| (4 intermediate revisions by 3 users not shown) | |||
| Line 20: | Line 20: | ||
=== pam_u2f === | === pam_u2f === | ||
The | The <code>pam_u2f</code> module implements the U2F (universal second factor) protocol. The protocol was initially developed by Yubico, Google and NXP and is nowadays hosted as an open-standard by the FIDO Alliance. All current and most legacy Yubikeys support the U2F protocol making this the preferred way to use Yubikeys for user login. | ||
Use this page to check whether your Yubikey supports '''FIDO U2F''' before starting: https://www.yubico.com/products/identifying-your-yubikey/ | Use this page to check whether your Yubikey supports '''FIDO U2F''' before starting: https://www.yubico.com/products/identifying-your-yubikey/ | ||
| Line 26: | Line 26: | ||
1. Connect your Yubikey | 1. Connect your Yubikey | ||
2. Create an authorization mapping file for your user. The authorization mapping file is like | 2. Create an authorization mapping file for your user. The authorization mapping file is like <code>~/.ssh/known_hosts</code> but for Yubikeys. | ||
# <code>nix-shell -p pam_u2f</code> | # <code>nix-shell -p pam_u2f</code> | ||
| Line 34: | Line 34: | ||
3. Verify that | 3. Verify that <code>~/.config/Yubico/u2f_keys</code> contains one line in the following style: | ||
<syntaxHighlight> | <syntaxHighlight> | ||
| Line 58: | Line 58: | ||
=== yubico-pam === | === yubico-pam === | ||
The | The <code>yubico-pam</code> module uses a OTP (one time password) challenge response to authenticate users. | ||
Use this page to check whether your Yubikey supports '''Yubico OTP''' before starting: https://www.yubico.com/products/identifying-your-yubikey/ | Use this page to check whether your Yubikey supports '''Yubico OTP''' before starting: https://www.yubico.com/products/identifying-your-yubikey/ | ||
You can enable challenge-response logins with the following commands: | You'll first need to install the necessary udev packages to your NixOS configuration:<syntaxhighlight lang="nix"> | ||
services.udev.packages = [ pkgs.yubikey-personalization ]; | |||
</syntaxhighlight>You can program the Yubikey for challenge-response on slot 2 and setup the current user for logon: | |||
# <code>nix-shell -p yubico-pam -p yubikey-manager</code> | |||
# <code>ykman otp chalresp --touch --generate 2</code> | |||
# <code>ykpamcfg -2 -v</code> | |||
Finally, you can enable challenge-response logins with the following commands: | |||
'''1.)''' | '''1.)''' | ||
| Line 68: | Line 74: | ||
to get the serial code and enter it into <code>yubico.id = [ "12345678" ];</code> | to get the serial code and enter it into <code>yubico.id = [ "12345678" ];</code> | ||
{{warning|1=Ignoring step 1 is considered insecure, any user could just plugin a yubikey and gain root access!}} | |||
'''2.)'''<syntaxHighlight lang=nix> | '''2.)'''<syntaxHighlight lang=nix> | ||
| Line 78: | Line 84: | ||
}; | }; | ||
</syntaxHighlight> | </syntaxHighlight> | ||
| Line 100: | Line 100: | ||
</syntaxHighlight> | </syntaxHighlight> | ||
Please note that the PCSC-Lite daemon [https://ludovicrousseau.blogspot.com/2019/06/gnupg-and-pcsc-conflicts.html sometimes conflicts] with gpg-agent. | Please note that the PCSC-Lite daemon [https://ludovicrousseau.blogspot.com/2019/06/gnupg-and-pcsc-conflicts.html sometimes conflicts] with gpg-agent. This can be solved by putting the line <code>disable-ccid</code> into <code>~/.gnupg/scdaemon.conf</code>. There is also a [https://nix-community.github.io/home-manager/options.xhtml#opt-programs.gpg.scdaemonSettings Home Manager Option] for that. | ||
== OTP == | == OTP == | ||
In order to manage OTP keys, you should install the <code>yubioath- | In order to manage OTP keys, you should install the <code>yubioath-flutter</code> package in your profile. | ||
This application will also require both the udev rules as well as pcscd enabled. | This application will also require both the udev rules as well as pcscd enabled. | ||