diff --git a/wiki/fido2.md b/wiki/fido2.md index 1a6e31b..de16c17 100644 --- a/wiki/fido2.md +++ b/wiki/fido2.md @@ -15,3 +15,9 @@ This section addresses various features of FIDO2. The usage of a FIDO2-Stick combined with [DM-Crypt](/wiki/linux/dm-crypt.md) is described in the [corresponding section of the DM-Crypt entry](/wiki/linux/dm-crypt.md#use-fido2-to-unlock-a-volume). + +### Lock a Linux Session on FIDO2 Key Removal + +An active Linux session can automatically be locked when a FIDO2 security key is removed. +The required setup is described in the +[corresponding systemd section](/wiki/linux/systemd.md#lock-session-when-removing-a-fido2-security-key). diff --git a/wiki/linux/dm-crypt.md b/wiki/linux/dm-crypt.md index c96fbe0..1acf920 100644 --- a/wiki/linux/dm-crypt.md +++ b/wiki/linux/dm-crypt.md @@ -140,14 +140,14 @@ The first line gives the `serial`, the second the `product`. The `product` should match the USB stick. After this create a file at `/etc/udev/rules.d/50-usbkey.rules` with the -following content. +following content to set up a new [UDEV rule](/wiki/linux/systemd.md). Assuming the `serial` is `14AB0000000096`. ```txt SUBSYSTEMS=="usb", ATTRS{serial}=="14AB0000000096", KERNEL=="sd*", SYMLINK+="usbkey%n" ``` -Then reload the udev rules by running the following command. +Then reload the UDEV rules by running the following command. ```sh udevadm control --reload-rules @@ -243,7 +243,7 @@ Next the hooks in the file `/etc/mkinitcpio.conf` need to be changed. It is recommended to set up [Plymouth]() so that the login screen is clean. Switch `udev` and other `HOOKS` to `systemd`. -Next remove the UDEV-rules for usb-decryption in `FILES`. +Next remove the [UDEV rules](/wiki/linux/systemd.md) for USB decryption in `FILES`. For this switch `udev keymap consolefont encrypt` to `systemd sd-vconsole sd-encrypt`. Then the file `/boot/loader/entries/arch.conf` and `/boot/loader/entries/arch-fallback.conf` needs @@ -267,6 +267,11 @@ sudo mkinitcpio -p linux reboot ``` +Removing the FIDO2 key after the volume has been unlocked does not close the already opened volume. +To additionally lock active sessions when the key is removed, the setup described in the +[corresponding systemd section](/wiki/linux/systemd.md#lock-session-when-removing-a-fido2-security-key) +can be used. + ### Removing a Keyslot LUKS supports multiple keyslots, allowing several passwords, key files or hardware tokens to unlock diff --git a/wiki/linux/hardware_(linux).md b/wiki/linux/hardware_(linux).md index a4f81b3..52b4680 100644 --- a/wiki/linux/hardware_(linux).md +++ b/wiki/linux/hardware_(linux).md @@ -76,7 +76,8 @@ like the RPM for fans. This section is based on a [Reddit comment by zedbraxmen](https://www.reddit.com/r/thinkpad/comments/wjb8qz/configuring_trackpoint_in_wayland/). -The sensitivity and speed of the classic TrackPoint on ThinkPads can be changed using UDEV rules. +The sensitivity and speed of the classic TrackPoint on ThinkPads can be changed using +[UDEV](/wiki/linux/systemd.md) rules. The following lines are an example for a potential file `.rules` located at `/etc/udev/rules.d/`. It could look something like the following. The values for sensitivity and speed could be adjusted. diff --git a/wiki/linux/pam.md b/wiki/linux/pam.md index fdfdffe..8dbce3c 100644 --- a/wiki/linux/pam.md +++ b/wiki/linux/pam.md @@ -10,7 +10,8 @@ other authentication mechanisms into services such as `sudo`, `login` and ## Authenticate `sudo` with a FIDO2 Security Key -This section describes how to configure a FIDO2 security key for authentication when running `sudo`. +This section describes how to configure a [FIDO2](/wiki/fido2.md) security key for authentication +when running `sudo`. The following guide is based on a [YouTube video by pixeledi](https://www.youtube.com/watch?v=e5k1ye-_tNs). @@ -19,7 +20,7 @@ First install the required package [PAM U2F](https://github.com/Yubico/pam-u2f) [Linux distribution](/wiki/linux.md#distributions). It is often packaged under the name `pam-u2f`. -Next create an UDEV rule that allows access to the FIDO2 device. +Next create an [UDEV rule](/wiki/linux/systemd.md) that allows access to the FIDO2 device. ```sh echo 'KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0664", GROUP="plugdev"' | sudo tee /etc/udev/rules.d/fido2-u2f.rules diff --git a/wiki/linux/systemd.md b/wiki/linux/systemd.md index 59c177a..9d22e72 100644 --- a/wiki/linux/systemd.md +++ b/wiki/linux/systemd.md @@ -115,6 +115,56 @@ Afterward the logind service has to be restarted sudo systemctl restart systemd-logind ``` +### Lock Session when Removing a FIDO2 Security Key + +An active session can automatically be locked when a [FIDO2](/wiki/fido2.md) security key is removed +by using an UDEV rule and `loginctl`. + +This guide specifically uses a FIDO2 security key. +The same general setup, however, can also be used with a regular USB device by adapting the UDEV +rule to match the corresponding device properties. + +First it should be verified that locking the session through systemd works. + +```sh +loginctl lock-sessions +``` + +Afterward UDEV events can be monitored while the FIDO2 security key is removed. + +```sh +sudo udevadm monitor --udev --property +``` + +In the `remove` event of the `hidraw` device, `ID_VENDOR_ID` and `ID_MODEL_ID` have to be +identified. + +```txt +SUBSYSTEM=hidraw +ID_SECURITY_TOKEN=1 +ID_VENDOR_ID= +ID_MODEL_ID= +``` + +Next the file `/etc/udev/rules.d/90-fido2-lock.rules` can be created and the following rule can then +be added with the previously determined values. + +```txt +ACTION=="remove", SUBSYSTEM=="hidraw", ENV{ID_SECURITY_TOKEN}=="1", ENV{ID_VENDOR_ID}=="", ENV{ID_MODEL_ID}=="", RUN+="/usr/bin/loginctl lock-sessions" +``` + +Finally, the UDEV rules have to be reloaded. + +```sh +sudo udevadm control --reload-rules +``` + +After reconnecting the FIDO2 security key, the active session should be locked as soon as the key is +removed. + +It is important to note, that removing a FIDO2 key after it has been used to unlock a +[DM-Crypt](/wiki/linux/dm-crypt.md) volume does not close or re-encrypt the already opened volume. + ### Limiting Journal Size The `journalctl` command stores persistent system logs which can grow significantly over time and