mirror of
https://github.com/arthur-pbty/arthur-os.git
synced 2026-08-01 20:28:16 +02:00
David Heinemeier HanssonandGitHub
45db959daf
* Split fido2 and fingerprint setups into setup and remove Don't make one thing do two things * Extract helpers and clean up * No need to hide them * Don't need these
82 lines
2.5 KiB
Bash
Executable File
82 lines
2.5 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Set up FIDO2 authentication for sudo and polkit
|
|
# omarchy:requires-sudo=true
|
|
|
|
set -e
|
|
|
|
|
|
check_fido2_hardware() {
|
|
tokens=$(fido2-token -L 2>/dev/null)
|
|
if [[ -z $tokens ]]; then
|
|
omarchy-echo-failure "\nNo FIDO2 device detected. Please plug it in (you may need to unlock it as well)."
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
setup_pam_config() {
|
|
# Configure sudo
|
|
if ! grep -q pam_u2f.so /etc/pam.d/sudo; then
|
|
omarchy-echo-info "Configuring sudo for FIDO2 authentication..."
|
|
sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/sudo
|
|
fi
|
|
|
|
# Configure polkit
|
|
if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_u2f.so' /etc/pam.d/polkit-1; then
|
|
omarchy-echo-info "Configuring polkit for FIDO2 authentication..."
|
|
sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/polkit-1
|
|
elif [[ ! -f /etc/pam.d/polkit-1 ]]; then
|
|
omarchy-echo-info "Creating polkit configuration with FIDO2 authentication..."
|
|
sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF'
|
|
auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2
|
|
auth required pam_unix.so
|
|
|
|
account required pam_unix.so
|
|
password required pam_unix.so
|
|
session required pam_unix.so
|
|
EOF
|
|
fi
|
|
}
|
|
|
|
omarchy-echo-success "Setting up FIDO2 device for authentication.\n"
|
|
|
|
# Install required packages
|
|
omarchy-echo-info "Installing required packages..."
|
|
omarchy-pkg-add libfido2 pam-u2f
|
|
|
|
if ! check_fido2_hardware; then
|
|
exit 1
|
|
fi
|
|
|
|
# Create the pamu2fcfg file
|
|
if [[ ! -f /etc/fido2/fido2 ]]; then
|
|
sudo mkdir -p /etc/fido2
|
|
omarchy-echo-success "\nLet's setup your device by confirming on the device now."
|
|
omarchy-echo-info "Touch your FIDO2 key when it lights up...\n"
|
|
|
|
if pamu2fcfg >/tmp/fido2; then
|
|
sudo mv /tmp/fido2 /etc/fido2/fido2
|
|
omarchy-echo-success "FIDO2 device registered successfully!"
|
|
else
|
|
omarchy-echo-failure "\nFIDO2 registration failed. Please try again."
|
|
exit 1
|
|
fi
|
|
else
|
|
omarchy-echo-info "FIDO2 device already registered."
|
|
fi
|
|
|
|
# Configure PAM
|
|
setup_pam_config
|
|
|
|
# Test with sudo
|
|
omarchy-echo-info "\nTesting FIDO2 authentication with sudo..."
|
|
omarchy-echo-info "Touch your FIDO2 key when prompted.\n"
|
|
|
|
if sudo echo "FIDO2 authentication test successful"; then
|
|
omarchy-echo-success "\nPerfect! FIDO2 authentication is now configured."
|
|
omarchy-echo-info "You can use your FIDO2 key for sudo and polkit authentication."
|
|
else
|
|
omarchy-echo-failure "\nVerification failed. You may want to check your configuration."
|
|
fi
|