Skip to content

Instantly share code, notes, and snippets.

@jmlemetayer

jmlemetayer/45-yubikey.rules

Created January 10, 2018 08:10
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jmlemetayer/20e936a2ef4c7e10804a69fdacab9ca4 to your computer and use it in GitHub Desktop.
Save jmlemetayer/20e936a2ef4c7e10804a69fdacab9ca4 to your computer and use it in GitHub Desktop.
Download ZIP
Using Yubikey U2F on Debian 9 for authentication
Raw
45-yubikey.rules
ACTION=="remove", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0407", RUN+="/usr/local/bin/gnome-lock"
Raw
gnome-lock
#!/bin/sh
for file in /tmp/.X11-unix/*
do
display=${file##*X}
user=$(/bin/ls -l --directory ${file} | cut -d " " -f 3)
uid=$(/usr/bin/id --user ${user})
if test -f /run/user/${uid}/gdm/Xauthority
then
DISPLAY=:${display} su ${user} -c "/usr/bin/dbus-send \
--type=method_call \
--dest=org.gnome.ScreenSaver \
/org/gnome/ScreenSaver \
org.gnome.ScreenSaver.Lock"
fi
done
@jmlemetayer
Copy link
Author

Using Yubikey U2F on Debian 9 for authentication

Prerequisites

Installation

U2F authentication

# Install the needed package.
sudo apt install libpam-u2f pamu2fcfg

# Configure U2F for the current user.
mkdir -p ${HOME}/.config/Yubico
# Your Yubikey must be inserted before to run pamu2fcfg.
pamu2fcfg -u ${USER} > ${HOME}/.config/Yubico/u2f_keys # Then press the Yubikey button to continue.

# Configure PAM
echo "auth required pam_u2f.so" | sudo tee -a /etc/pam.d/common-auth

Reboot or logout to finish the setup.

Now, for every local authentication (console login, GUI login, sudo, desktop screen lock) you will need to used your Yubikey. Note that remote authentication (SSH logins) will not be impacted.

Lock screen when the Yubikey is unplugged

# Install the provided files
wget -qO- https://gist.github.com/jmlemetayer/20e936a2ef4c7e10804a69fdacab9ca4/raw/45-yubikey.rules | sudo tee /etc/udev/rules.d/45-yubikey.rules
wget -qO- https://gist.github.com/jmlemetayer/20e936a2ef4c7e10804a69fdacab9ca4/raw/gnome-lock | sudo tee /usr/local/bin/gnome-lock
sudo chmod +x /usr/local/bin/gnome-lock

# Reload udev rules
sudo udevadm control --reload-rules
sudo udevadm trigger

When logged in, just unplug your Yubikey to lock your screen.

Resources

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment