diff options
| -rw-r--r-- | lib/authorized_yubikeys | 1 | ||||
| -rw-r--r-- | lib/common.nix | 4 | ||||
| -rw-r--r-- | lib/linux.nix | 1 | ||||
| -rw-r--r-- | machines/helium.nix | 11 |
4 files changed, 15 insertions, 2 deletions
diff --git a/lib/authorized_yubikeys b/lib/authorized_yubikeys new file mode 100644 index 0000000..9e4c5a6 --- /dev/null +++ b/lib/authorized_yubikeys @@ -0,0 +1 @@ +ben:cccccchklur diff --git a/lib/common.nix b/lib/common.nix index c977cdb..0fa9302 100644 --- a/lib/common.nix +++ b/lib/common.nix @@ -32,6 +32,10 @@ in keyboard.options = [ "caps:ctrl_modifier" ]; file = { + yubikeys = { + source = ./authorized_yubikeys; + target = ".yubico/authorized_yubikeys"; + }; editorconfig = { source = ./editorconfig; target = ".editorconfig"; diff --git a/lib/linux.nix b/lib/linux.nix index c98124f..912e8bc 100644 --- a/lib/linux.nix +++ b/lib/linux.nix @@ -135,6 +135,7 @@ in xterm yank youtube-dl + yubioath-desktop zathura # languages i regularly use diff --git a/machines/helium.nix b/machines/helium.nix index dda6569..564dd28 100644 --- a/machines/helium.nix +++ b/machines/helium.nix @@ -7,7 +7,11 @@ let in { imports = [ ./users.nix ]; - security.sudo.wheelNeedsPassword = false; + security.sudo.wheelNeedsPassword = true; + security.pam.yubico.enable = true; + security.pam.yubico.debug = false; + security.pam.yubico.control = "sufficient"; # use yubikey in lieu of password + security.pam.yubico.mode = "challenge-response"; boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" @@ -39,7 +43,10 @@ in { fira fira-code fira-code-symbols ]; - environment.systemPackages = [ + environment.systemPackages = with pkgs; [ + yubioath-desktop + yubico-pam + yubikey-manager ]; nixpkgs = { |