Fido2: Added Buzzkill Guide for Linux

wiki/fido2.md

@@ -15,3 +15,9 @@ This section addresses various features of FIDO2.
 
 The usage of a FIDO2-Stick combined with [DM-Crypt](/wiki/linux/dm-crypt.md) is described in the
 [corresponding section of the DM-Crypt entry](/wiki/linux/dm-crypt.md#use-fido2-to-unlock-a-volume).
+
+### Lock a Linux Session on FIDO2 Key Removal
+
+An active Linux session can automatically be locked when a FIDO2 security key is removed.
+The required setup is described in the
+[corresponding systemd section](/wiki/linux/systemd.md#lock-session-when-removing-a-fido2-security-key).

wiki/linux/dm-crypt.md

@@ -140,14 +140,14 @@ The first line gives the `serial`, the second the `product`.
 The `product` should match the USB stick.
 
 After this create a file at `/etc/udev/rules.d/50-usbkey.rules` with the
-following content.
+following content to set up a new [UDEV rule](/wiki/linux/systemd.md).
 Assuming the `serial` is `14AB0000000096`.
 
 ```txt
 SUBSYSTEMS=="usb", ATTRS{serial}=="14AB0000000096", KERNEL=="sd*", SYMLINK+="usbkey%n"
 ```
 
-Then reload the udev rules by running the following command.
+Then reload the UDEV rules by running the following command.
 
 ```sh
 udevadm control --reload-rules
@@ -243,7 +243,7 @@ Next the hooks in the file `/etc/mkinitcpio.conf` need to be changed.
 It is recommended to set up [Plymouth]() so that the login screen is clean.
 Switch `udev` and other `HOOKS` to `systemd`.
 
-Next remove the UDEV-rules for usb-decryption in `FILES`.
+Next remove the [UDEV rules](/wiki/linux/systemd.md) for USB decryption in `FILES`.
 For this switch `udev keymap consolefont encrypt` to `systemd sd-vconsole sd-encrypt`.
 
 Then the file `/boot/loader/entries/arch.conf` and `/boot/loader/entries/arch-fallback.conf` needs
@@ -267,6 +267,11 @@ sudo mkinitcpio -p linux
 reboot
 ```
 
+Removing the FIDO2 key after the volume has been unlocked does not close the already opened volume.
+To additionally lock active sessions when the key is removed, the setup described in the
+[corresponding systemd section](/wiki/linux/systemd.md#lock-session-when-removing-a-fido2-security-key)
+can be used.
+
 ### Removing a Keyslot
 
 LUKS supports multiple keyslots, allowing several passwords, key files or hardware tokens to unlock

wiki/linux/hardware_(linux).md

@@ -76,7 +76,8 @@ like the RPM for fans.
 This section is based on a
 [Reddit comment by zedbraxmen](https://www.reddit.com/r/thinkpad/comments/wjb8qz/configuring_trackpoint_in_wayland/).
 
-The sensitivity and speed of the classic TrackPoint on ThinkPads can be changed using UDEV rules.
+The sensitivity and speed of the classic TrackPoint on ThinkPads can be changed using
+[UDEV](/wiki/linux/systemd.md) rules.
 The following lines are an example for a potential file `.rules` located at `/etc/udev/rules.d/`.
 It could look something like the following.
 The values for sensitivity and speed could be adjusted.

wiki/linux/pam.md

@@ -10,7 +10,8 @@ other authentication mechanisms into services such as `sudo`, `login` and
 
 ## Authenticate `sudo` with a FIDO2 Security Key
 
-This section describes how to configure a FIDO2 security key for authentication when running `sudo`.
+This section describes how to configure a [FIDO2](/wiki/fido2.md) security key for authentication
+when running `sudo`.
 The following guide is based on a
 [YouTube video by pixeledi](https://www.youtube.com/watch?v=e5k1ye-_tNs).
 
@@ -19,7 +20,7 @@ First install the required package [PAM U2F](https://github.com/Yubico/pam-u2f)
 [Linux distribution](/wiki/linux.md#distributions).
 It is often packaged under the name `pam-u2f`.
 
-Next create an UDEV rule that allows access to the FIDO2 device.
+Next create an [UDEV rule](/wiki/linux/systemd.md) that allows access to the FIDO2 device.
 
 ```sh
 echo 'KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0664", GROUP="plugdev"' | sudo tee /etc/udev/rules.d/fido2-u2f.rules

wiki/linux/systemd.md

@@ -115,6 +115,56 @@ Afterward the logind service has to be restarted
 sudo systemctl restart systemd-logind
 ```
 
+### Lock Session when Removing a FIDO2 Security Key
+
+An active session can automatically be locked when a [FIDO2](/wiki/fido2.md) security key is removed
+by using an UDEV rule and `loginctl`.
+
+This guide specifically uses a FIDO2 security key.
+The same general setup, however, can also be used with a regular USB device by adapting the UDEV
+rule to match the corresponding device properties.
+
+First it should be verified that locking the session through systemd works.
+
+```sh
+loginctl lock-sessions
+```
+
+Afterward UDEV events can be monitored while the FIDO2 security key is removed.
+
+```sh
+sudo udevadm monitor --udev --property
+```
+
+In the `remove` event of the `hidraw` device, `ID_VENDOR_ID` and `ID_MODEL_ID` have to be
+identified.
+
+```txt
+SUBSYSTEM=hidraw
+ID_SECURITY_TOKEN=1
+ID_VENDOR_ID=<vendor-id>
+ID_MODEL_ID=<model-id>
+```
+
+Next the file `/etc/udev/rules.d/90-fido2-lock.rules` can be created and the following rule can then
+be added with the previously determined values.
+
+```txt
+ACTION=="remove", SUBSYSTEM=="hidraw", ENV{ID_SECURITY_TOKEN}=="1", ENV{ID_VENDOR_ID}=="<vendor-id>", ENV{ID_MODEL_ID}=="<model-id>", RUN+="/usr/bin/loginctl lock-sessions"
+```
+
+Finally, the UDEV rules have to be reloaded.
+
+```sh
+sudo udevadm control --reload-rules
+```
+
+After reconnecting the FIDO2 security key, the active session should be locked as soon as the key is
+removed.
+
+It is important to note, that removing a FIDO2 key after it has been used to unlock a
+[DM-Crypt](/wiki/linux/dm-crypt.md) volume does not close or re-encrypt the already opened volume.
+
 ### Limiting Journal Size
 
 The `journalctl` command stores persistent system logs which can grow significantly over time and