diff options
| author | Alyssa Ross <hi@alyssa.is> | 2019-07-07 18:59:54 +0000 |
|---|---|---|
| committer | Alyssa Ross <hi@alyssa.is> | 2019-08-13 21:59:18 +0000 |
| commit | 45572a0336bce7d2bf36429491a45ebb34a70a0f (patch) | |
| tree | ce4270cd90e205852205fc49d81de6b33c542603 /modules/workstation/hardware | |
| parent | 42691e8f5805457b9e4a1f04d9381fed316e96b2 (diff) | |
| download | nixlib-45572a0336bce7d2bf36429491a45ebb34a70a0f.tar nixlib-45572a0336bce7d2bf36429491a45ebb34a70a0f.tar.gz nixlib-45572a0336bce7d2bf36429491a45ebb34a70a0f.tar.bz2 nixlib-45572a0336bce7d2bf36429491a45ebb34a70a0f.tar.lz nixlib-45572a0336bce7d2bf36429491a45ebb34a70a0f.tar.xz nixlib-45572a0336bce7d2bf36429491a45ebb34a70a0f.tar.zst nixlib-45572a0336bce7d2bf36429491a45ebb34a70a0f.zip | |
modules/yubikey: use Yubikey for sudo via U2F
Diffstat (limited to 'modules/workstation/hardware')
| -rw-r--r-- | modules/workstation/hardware/yubikey/default.nix | 8 | ||||
| -rw-r--r-- | modules/workstation/hardware/yubikey/u2f_keys | 1 |
2 files changed, 9 insertions, 0 deletions
diff --git a/modules/workstation/hardware/yubikey/default.nix b/modules/workstation/hardware/yubikey/default.nix index 23a940f2ee8a..d047246bb20d 100644 --- a/modules/workstation/hardware/yubikey/default.nix +++ b/modules/workstation/hardware/yubikey/default.nix @@ -2,4 +2,12 @@ { services.udev.packages = with pkgs; [ yubikey-personalization ]; + + security.pam.services.sudo.u2fAuth = true; + security.sudo.extraConfig = '' + Defaults timestamp_timeout=0 + ''; + + security.pam.u2f.cue = true; + security.pam.u2f.authFile = pkgs.copyPathToStore ./u2f_keys; } diff --git a/modules/workstation/hardware/yubikey/u2f_keys b/modules/workstation/hardware/yubikey/u2f_keys new file mode 100644 index 000000000000..c5601f5f0703 --- /dev/null +++ b/modules/workstation/hardware/yubikey/u2f_keys @@ -0,0 +1 @@ +qyliss:HIWnn91xwo-f14WjdDSdiX2Rs9NdJr2QF4_5_gYUpTkennbpR8AOXHmfEzj5llyLyb-_WEaVUQU59ieCamq9SA,044196971044cff2724ea9ab4624ef860fde32337acc6c3a323899f36a50bf87d06f535c146111f96925455f8c07addff769dfd502c216a9683c70898bb521ada5 |