YubiKey lock screen - Revision history

Admin: /* HOW */

2013-04-04T15:37:24Z

HOW

← Older revision		Revision as of 18:37, 4 April 2013
Line 30:		Line 30:
	yubimap="/etc/yubikey_decmappings"		yubimap="/etc/yubikey_decmappings"
	ykinfo=$(/usr/bin/ykinfo -q -s)		ykinfo=$(/usr/bin/ykinfo -q -s)

	if [ ! -z "${PAM_USER}" ]		if [ ! -z "${PAM_USER}" ]
	then		then
Line 51:		Line 50:
	fi		fi
	else		else
	~~user~~=$(ps aux \| ~~grep~~ gnome-~~screensaver~~ \| head -n 1 \| awk '{print $1}')		gnome_session=$(/usr/bin/ps aux \| fgrep gnome-session \| head -n 1)
			user=$(echo ${gnome_session} \| awk '{print $1}')
			GNOME_SESSION_PROC=$(echo $gnome_session \| awk '{print $2}')
			export `grep -z DBUS_SESSION_BUS_ADDRESS /proc/$GNOME_SESSION_PROC/environ`
			export DISPLAY=":0"
			current_lock_status=$(/sbin/runuser ${user} -c "/usr/bin/qdbus org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.GetActive")
	echo "AUTH-GNOME $(date) $(whoami) - '${user}' - '${ykinfo}' - '$0' '$1'" >>${log}		echo "AUTH-GNOME $(date) $(whoami) - '${user}' - '${ykinfo}' - '$0' '$1'" >>${log}
	~~export DISPLAY=":0"~~
	~~current_lock_status=$(sudo -u ${user} /usr/bin/gnome-screensaver-command --query)~~
	if [ "$1" == "enable" ]		if [ "$1" == "enable" ]
	then		then
	if [ -n ${user} -a "$(fgrep -wc ${user} ${yubimap})" == "1" -a "~~$(echo~~ ${current_lock_status} ~~\| fgrep -wc inactive)~~" == "1" ]		if [ -n ${user} -a "$(fgrep -wc ${user} ${yubimap})" == "1" -a "${current_lock_status}" == "false" ]
	then		then
	~~sudo -u~~ ${user} /usr/bin/~~gnome~~-~~screensaver~~-~~command~~ -~~l >>${log} 2>&1~~		/sbin/runuser ${user} -c "/usr/bin/dbus-send --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.Lock"
	touch /tmp/.yubikey_lock		touch /tmp/.yubikey_lock
	fi		fi
Line 67:		Line 69:
	if [ -f /tmp/.yubikey_lock ]		if [ -f /tmp/.yubikey_lock ]
	then		then
	~~sudo -u~~ ${user} /~~usr~~/~~bin~~/gnome~~-screensaver-command -d >>${log} 2>&1~~		/sbin/runuser ${user} -c "dbus-send --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.SetActive boolean:false"
	rm -f /tmp/.yubikey_lock		rm -f /tmp/.yubikey_lock
	fi		fi
Line 78:		Line 80:
	Your /etc/yubikey_decmappings should contain user:key, you can see that with ykinfo -q -s (which key should be able to unlock what login if in multiple desktop environment )		Your /etc/yubikey_decmappings should contain user:key, you can see that with ykinfo -q -s (which key should be able to unlock what login if in multiple desktop environment )

	The ykinfo binary is available in rawhide ( or >= fedora 19 )		The ykinfo binary is available in rawhide ( or >= fedora 18 ).

			Also, since fedora 17 it seems for me at least that I can't use gnome-screensaver-command to query the screensaver so I switched to dbus and runuser :)

	Latest changes to the script enable it to only unlock if it was locked by the yubikey !		Latest changes to the script enable it to only unlock if it was locked by the yubikey !

Admin: /* HOW */

2013-04-03T15:41:54Z

HOW

← Older revision		Revision as of 18:41, 3 April 2013
Line 73:		Line 73:
	fi		fi
	fi		fi

	</source>		</source>

Admin: /* HOW */

2013-04-03T15:39:11Z

HOW

← Older revision		Revision as of 18:39, 3 April 2013
Line 75:		Line 75:
	</source>		</source>

	Your /etc/yubikey_decmappings should contain user:~~000key~~, ~~padding with 000(~~you can see that ~~in env or~~ ykinfo -q -s) (which key should be able to unlock what login if in multiple desktop environment )		Your /etc/yubikey_decmappings should contain user:key, you can see that with ykinfo -q -s (which key should be able to unlock what login if in multiple desktop environment )

	The ykinfo binary is available in rawhide ( or >= fedora 19 )		The ykinfo binary is available in rawhide ( or >= fedora 19 )

Admin: /* HOW */

2013-04-03T15:38:19Z

HOW

← Older revision		Revision as of 18:38, 3 April 2013
Line 33:		Line 33:
	if [ ! -z "${PAM_USER}" ]		if [ ! -z "${PAM_USER}" ]
	then		then
	echo "AUTH-PAM $(date) $(whoami) - '${PAM_USER}' '$0'" >>${log}		echo "AUTH-PAM $(date) $(whoami) - '${PAM_USER}' '$0'" >>${log}
	if [ "$(fgrep -wc ${PAM_USER} ${yubimap})" == "1" ]		if [ "$(fgrep -wc ${PAM_USER} ${yubimap})" == "1" ]
	then		then
	echo "IT REQUIRES YUBIKEY." >>${log}		echo "IT REQUIRES YUBIKEY." >>${log}
	if [ -z "${ykinfo}" ]		if [ -z "${ykinfo}" ]
	then		then
	echo "Didn't find a yubikey." >>${log}		echo "Didn't find a yubikey." >>${log}
	exit 1		exit 1
	fi		fi
	echo "Searching for ${PAM_USER}:${ykinfo} in ${yubimap}. Found:" >>${log}		echo "Searching for ${PAM_USER}:${ykinfo} in ${yubimap}. Found:" >>${log}
	fgrep -w ${PAM_USER}:${ykinfo} ${yubimap} >>${log}		fgrep -w ${PAM_USER}:${ykinfo} ${yubimap} >>${log}
	exitcode=$?		exitcode=$?
	echo "EXITCODE=${exitcode}" >>${log}		echo "EXITCODE=${exitcode}" >>${log}
	exit ${exitcode}		exit ${exitcode}
	else		else
	exit 0		exit 0
	fi		fi
	else		else
	user=$(ps aux \| grep gnome-screensaver \| head -n 1 \| awk '{print $1}')		user=$(ps aux \| grep gnome-screensaver \| head -n 1 \| awk '{print $1}')
	echo "AUTH-GNOME $(date) $(whoami) - '${user}' '$0' '$1'" >> ${log}		echo "AUTH-GNOME $(date) $(whoami) - '${user}' - '${ykinfo}' - '$0' '$1'" >>${log}
	export DISPLAY=":0"		export DISPLAY=":0"
	current_lock_status=$(sudo -u ${user} /usr/bin/gnome-screensaver-command --query)		current_lock_status=$(sudo -u ${user} /usr/bin/gnome-screensaver-command --query)
	if [ "$1" == "enable" ]		if [ "$1" == "enable" ]
	then		then
	if [ -n ${user} -a "$(fgrep -c ${user~~}:${ID_SERIAL_SHORT~~} ${yubimap})" == "1" -a "$(echo ${current_lock_status} \| fgrep -wc inactive)" == "1" ]		if [ -n ${user} -a "$(fgrep -wc ${user} ${yubimap})" == "1" -a "$(echo ${current_lock_status} \| fgrep -wc inactive)" == "1" ]
	then		then
	sudo -u ${user} /usr/bin/gnome-screensaver-command -l >>${log} 2>&1		sudo -u ${user} /usr/bin/gnome-screensaver-command -l >>${log} 2>&1
	touch /tmp/.yubikey_lock		touch /tmp/.yubikey_lock
	fi		fi
	else		else
	if [ -n ${user} -a "$(~~grep~~ -c ${user}:${ykinfo} ${yubimap})" == "1" ]		if [ -n ${user} -a "$(fgrep -wc ${user}:${ykinfo} ${yubimap})" == "1" ]
	then		then
	if [ -f /tmp/.yubikey_lock ]		if [ -f /tmp/.yubikey_lock ]
	then		then
	sudo -u ${user} /usr/bin/gnome-screensaver-command -d >>${log} 2>&1		sudo -u ${user} /usr/bin/gnome-screensaver-command -d >>${log} 2>&1
	rm -f /tmp/.yubikey_lock		rm -f /tmp/.yubikey_lock
	fi		fi
	fi		fi
	fi		fi
	fi		fi
	</source>		</source>

Admin: /* HOW */

2013-04-03T15:28:10Z

HOW

← Older revision		Revision as of 18:28, 3 April 2013
Line 29:		Line 29:
	log="/tmp/yubi_lock_log"		log="/tmp/yubi_lock_log"
	yubimap="/etc/yubikey_decmappings"		yubimap="/etc/yubikey_decmappings"
	~~user~~=$(~~ps aux \| grep gnome-screensaver \| head -n 1 \| awk '{print $1}')~~		ykinfo=$(/usr/bin/ykinfo -q -s)
	~~echo "$(date) $(whoami) - '${user}' '$0' '$1'" >> ${log}~~
	~~export DISPLAY=":0"~~
	~~current_lock_status=$(sudo -u ${user}~~ /usr/bin/~~gnome-screensaver-command~~ --~~query~~)

	if [ "$~~1" == "enable~~" ]		if [ ! -z "${PAM_USER}" ]
	then		then
	~~if [~~ -n ${~~user~~} -a "$(~~grep~~ -~~c ${user}:~~${~~ID_SERIAL_SHORT~~} ${yubimap})" == "1" -a "~~$(echo~~ ${~~current_lock_status~~} ~~\| fgrep~~ -~~wc inactive)~~" ~~== "1~~" ]		echo "AUTH-PAM $(date) $(whoami) - '${PAM_USER}' '$0'" >>${log}
	then		if [ "$(fgrep -wc ${PAM_USER} ${yubimap})" == "1" ]
	~~sudo~~ -u ${~~user~~} ~~/usr/bin/gnome-screensaver-command -l~~ >> ${log} 2>&1		then
	~~touch /tmp/.yubikey_lock~~		echo "IT REQUIRES YUBIKEY." >>${log}
	fi		if [ -z "${ykinfo}" ]
			then
			echo "Didn't find a yubikey." >>${log}
			exit 1
			fi
			echo "Searching for ${PAM_USER}:${ykinfo} in ${yubimap}. Found:" >>${log}
			fgrep -w ${PAM_USER}:${ykinfo} ${yubimap} >>${log}
			exitcode=$?
			echo "EXITCODE=${exitcode}" >>${log}
			exit ${exitcode}
			else
			exit 0
			fi
	else		else
	if [ -n ${user} -a "$(~~grep~~ -c ${user}:~~000~~$(~~ykinfo~~ -q -s) ${yubimap})" == "1" ]		user=$(ps aux \| grep gnome-screensaver \| head -n 1 \| awk '{print $1}')
	then		echo "AUTH-GNOME $(date) $(whoami) - '${user}' '$0' '$1'" >> ${log}
	if [ -f /tmp/.yubikey_lock ]		export DISPLAY=":0"
	then		current_lock_status=$(sudo -u ${user} /usr/bin/gnome-screensaver-command --query)
	sudo -u ${user} /usr/bin/gnome-screensaver-command -d >> ${log} 2>&1		if [ "$1" == "enable" ]
	rm -f /tmp/.yubikey_lock		then
	fi		if [ -n ${user} -a "$(fgrep -c ${user}:${ID_SERIAL_SHORT} ${yubimap})" == "1" -a "$(echo ${current_lock_status} \| fgrep -wc inactive)" == "1" ]
	fi		then
			sudo -u ${user} /usr/bin/gnome-screensaver-command -l >>${log} 2>&1
			touch /tmp/.yubikey_lock
			fi
			else
			if [ -n ${user} -a "$(grep -c ${user}:${ykinfo} ${yubimap})" == "1" ]
			then
			if [ -f /tmp/.yubikey_lock ]
			then
			sudo -u ${user} /usr/bin/gnome-screensaver-command -d >>${log} 2>&1
			rm -f /tmp/.yubikey_lock
			fi
			fi
			fi
	fi		fi
	</source>		</source>
Line 58:		Line 80:

	Latest changes to the script enable it to only unlock if it was locked by the yubikey !		Latest changes to the script enable it to only unlock if it was locked by the yubikey !

			In order for the pam method to work, you'd need these 2 lines in the required /etc/pam.d ( don't know which one your system uses. My fedora used /etc/pam.d/password-auth and /etc/pam.d/system-auth ):

			<source lang="bash">
			auth required pam_exec.so quiet /usr/local/bin/gnome-lock
			auth sufficient pam_unix.so try_first_pass nullok
			</source>

	==ISSUES==		==ISSUES==

Admin: /* ISSUES */

2013-04-02T14:33:03Z

ISSUES

← Older revision		Revision as of 17:33, 2 April 2013
Line 71:		Line 71:
	sudo -u ${user} dbus-send --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.SetActive boolean:false # for unlock		sudo -u ${user} dbus-send --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.SetActive boolean:false # for unlock
	sudo -u ${user} dbus-send --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.Lock # for lock		sudo -u ${user} dbus-send --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.Lock # for lock
			sudo -u ${user} qdbus org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.GetActive # to query via qdbus
			sudo -u ${user} /usr/bin/gnome-screensaver-command --query
	</source>		</source>

Admin: /* HOW */

2013-04-02T14:31:41Z

HOW

← Older revision		Revision as of 17:31, 2 April 2013
Line 29:		Line 29:
	log="/tmp/yubi_lock_log"		log="/tmp/yubi_lock_log"
	yubimap="/etc/yubikey_decmappings"		yubimap="/etc/yubikey_decmappings"
	echo "$(date) $(whoami) '$0' '$1'" >> ${log}		user=$(ps aux \| grep gnome-screensaver \| head -n 1 \| awk '{print $1}')
			echo "$(date) $(whoami) - '${user}' '$0' '$1'" >> ${log}
			export DISPLAY=":0"
			current_lock_status=$(sudo -u ${user} /usr/bin/gnome-screensaver-command --query)

	~~user=`ps aux \| grep gnome-screensaver \| head -n 1 \| awk '{print $1}'`~~
	~~export DISPLAY=":0"~~
	if [ "$1" == "enable" ]		if [ "$1" == "enable" ]
	then		then
	if [ -n ${user} -a "$(grep -c ${user}:${ID_SERIAL_SHORT} ${yubimap})" == "1" ]		if [ -n ${user} -a "$(grep -c ${user}:${ID_SERIAL_SHORT} ${yubimap})" == "1" -a "$(echo ${current_lock_status} \| fgrep -wc inactive)" == "1" ]
	then		then
	sudo -u ${user} /usr/bin/gnome-screensaver-command -l >> ${log} 2>&1		sudo -u ${user} /usr/bin/gnome-screensaver-command -l >> ${log} 2>&1
			touch /tmp/.yubikey_lock
	fi		fi
	else		else
	if [ -n ${user} -a "$(grep -c ${user}:000$(ykinfo -q -s) ${yubimap})" == "1" ]		if [ -n ${user} -a "$(grep -c ${user}:000$(ykinfo -q -s) ${yubimap})" == "1" ]
	then		then
	sudo -u ${user} /usr/bin/gnome-screensaver-command -d >> ${log} 2>&1		if [ -f /tmp/.yubikey_lock ]
			then
			sudo -u ${user} /usr/bin/gnome-screensaver-command -d >> ${log} 2>&1
			rm -f /tmp/.yubikey_lock
			fi
	fi		fi
	fi		fi
	</source>		</source>

	Your /etc/yubikey_decmappings should contain user:000key, padding with 000(you can see that in env) (which key should be able to unlock what login if in multiple desktop environment )		Your /etc/yubikey_decmappings should contain user:000key, padding with 000(you can see that in env or ykinfo -q -s) (which key should be able to unlock what login if in multiple desktop environment )

			The ykinfo binary is available in rawhide ( or >= fedora 19 )

			Latest changes to the script enable it to only unlock if it was locked by the yubikey !

	==ISSUES==		==ISSUES==

Admin: /* HOW */

2012-10-24T12:19:36Z

HOW

← Older revision		Revision as of 15:19, 24 October 2012
Line 28:		Line 28:
	#!/bin/bash		#!/bin/bash
	log="/tmp/yubi_lock_log"		log="/tmp/yubi_lock_log"
			yubimap="/etc/yubikey_decmappings"
	echo "$(date) $(whoami) '$0' '$1'" >> ${log}		echo "$(date) $(whoami) '$0' '$1'" >> ${log}

Line 34:		Line 35:
	if [ "$1" == "enable" ]		if [ "$1" == "enable" ]
	then		then
	if [ -n ${user} -a "$(grep -c ${user}:${ID_SERIAL_SHORT} ~~/etc/yubikey_decmappings~~)" == "1" ]		if [ -n ${user} -a "$(grep -c ${user}:${ID_SERIAL_SHORT} ${yubimap})" == "1" ]
	then		then
	sudo -u ${user} /usr/bin/gnome-screensaver-command -l >> ${log} 2>&1		sudo -u ${user} /usr/bin/gnome-screensaver-command -l >> ${log} 2>&1
	fi		fi
	else		else
	if [ -n ${user} -a "$(grep -c ${user}:000$(ykinfo -q -s) ~~/etc/yubikey_decmappings~~)" == "1" ]		if [ -n ${user} -a "$(grep -c ${user}:000$(ykinfo -q -s) ${yubimap})" == "1" ]
	then		then
	sudo -u ${user} /usr/bin/gnome-screensaver-command -d >> ${log} 2>&1		sudo -u ${user} /usr/bin/gnome-screensaver-command -d >> ${log} 2>&1

Admin: /* HOW */

2012-10-24T09:52:54Z

HOW

← Older revision		Revision as of 12:52, 24 October 2012
Line 22:		Line 22:
	</source>		</source>

	And you should create the ~~2 scripts~~ (you'll probably have to comment out default ~~requirretty~~ in /etc/sudoers) :		And you should create the following script (you'll probably have to comment out default requiretty in /etc/sudoers) :

	<source lang="bash">		<source lang="bash">

Admin: /* HOW */

2012-10-24T09:42:54Z

HOW

← Older revision		Revision as of 12:42, 24 October 2012
Line 13:		Line 13:
	Create a /etc/udev/rules.d/85-screen-lock-toggle.rules		Create a /etc/udev/rules.d/85-screen-lock-toggle.rules
	<source lang="bash">		<source lang="bash">
	SUBSYSTEM=="usb", ACTION=="remove", ENV{ID_VENDOR_ID}=="1050", ENV{~~ID_SERIAL_SHORT~~}=="~~0001121136~~", RUN+="/usr/local/bin/gnome-lock enable"		SUBSYSTEM=="usb", ACTION=="remove", ENV{ID_VENDOR_ID}=="1050", ENV{ID_MODEL_ID}="0010", RUN+="/usr/local/bin/gnome-lock enable"
	SUBSYSTEM=="usb", ACTION=="add", ENV{ID_VENDOR_ID}=="1050", ENV{ID_MODEL_ID}=="0010", RUN+="/usr/local/bin/gnome-lock disable"		SUBSYSTEM=="usb", ACTION=="add", ENV{ID_VENDOR_ID}=="1050", ENV{ID_MODEL_ID}=="0010", RUN+="/usr/local/bin/gnome-lock disable"
	</source>		</source>